From 8a67f1a02e2c29c9297a19a75ae44591efa62ac1 Mon Sep 17 00:00:00 2001 From: Andrew Nesbitt Date: Fri, 31 Jul 2026 12:53:57 +0100 Subject: [PATCH] Publish data/advisories.json indexed by formula name --- .github/workflows/regenerate.yml | 3 + Rakefile | 8 + data/advisories.json | 4116 ++++++++++++++++++++++++++++++ lib/advisory_index.rb | 60 + test/advisory_index_test.rb | 83 + 5 files changed, 4270 insertions(+) create mode 100644 data/advisories.json create mode 100644 lib/advisory_index.rb create mode 100644 test/advisory_index_test.rb diff --git a/.github/workflows/regenerate.yml b/.github/workflows/regenerate.yml index d0404743c..c009ba7b2 100644 --- a/.github/workflows/regenerate.yml +++ b/.github/workflows/regenerate.yml @@ -37,6 +37,9 @@ jobs: HOMEBREW_DEVELOPER: "1" run: brew generate-vulns-advisories advisories + - name: Concatenate advisories + run: rake advisories:concat + - name: Open pull request env: GITHUB_TOKEN: ${{ github.token }} diff --git a/Rakefile b/Rakefile index 608c620ce..feb0eb59c 100644 --- a/Rakefile +++ b/Rakefile @@ -19,3 +19,11 @@ namespace :repology do RepologyIndex.new(page_limit: limit).write("data/repology.json") end end + +namespace :advisories do + desc "Concatenate advisories/*.json into data/advisories.json indexed by formula" + task :concat do + require_relative "lib/advisory_index" + AdvisoryIndex.write("advisories", "data/advisories.json") + end +end diff --git a/data/advisories.json b/data/advisories.json new file mode 100644 index 000000000..2329603bd --- /dev/null +++ b/data/advisories.json @@ -0,0 +1,4116 @@ +{ + "meta": { + "count": 44, + "schema_version": "1.7.3" + }, + "advisories": { + "augeas": [ + { + "schema_version": "1.7.3", + "id": "BREW-augeas-CVE-2025-2588", + "published": "2026-07-18T04:02:33Z", + "modified": "2026-07-18T04:02:33Z", + "upstream": [ + "CVE-2025-2588" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "augeas", + "purl": "pkg:brew/augeas" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.14.1_2" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://github.com/hercules-team/augeas/commit/af2aa88ab37fc48167d8c5e43b1770a4ba2ff403.patch?full_index=1" + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "Hercules Augeas fa.c re_case_expand null pointer dereference", + "details": "A vulnerability has been found in Hercules Augeas 1.14.1 and classified as problematic. This vulnerability affects the function re_case_expand of the file src/fa.c. The manipulation of the argument re leads to null pointer dereference. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/2xxx/CVE-2025-2588.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2588" + }, + { + "type": "ADVISORY", + "url": "https://vuldb.com/?id.300568" + }, + { + "type": "ADVISORY", + "url": "https://vuldb.com/?submit.517281" + }, + { + "type": "REPORT", + "url": "https://github.com/hercules-team/augeas/issues/852" + }, + { + "type": "REPORT", + "url": "https://github.com/hercules-team/augeas/issues/852#issue-2905999609" + }, + { + "type": "REPORT", + "url": "https://vuldb.com/?ctiid.300568" + } + ] + } + ], + "glibc": [ + { + "schema_version": "1.7.3", + "id": "BREW-glibc-CVE-2024-2961", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-14T23:39:39Z", + "upstream": [ + "CVE-2024-2961" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "glibc", + "purl": "pkg:brew/glibc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.39" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.7.debian.tar.xz", + "apply": [ + "patches/any/CVE-2024-2961.patch", + "patches/any/CVE-2024-33599.patch", + "patches/any/CVE-2024-33600_1.patch", + "patches/any/CVE-2024-33600_2.patch", + "patches/any/CVE-2024-33601_33602.patch", + "patches/any/CVE-2025-0395.patch", + "patches/any/CVE-2025-5702.patch", + "patches/any/CVE-2025-8058.patch", + "patches/CVE-2025-15281.patch", + "patches/CVE-2026-0861.patch", + "patches/CVE-2026-0915.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/04/17/9" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/04/18/4" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/04/24/2" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/05/27/1" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/05/27/2" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/05/27/3" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/05/27/4" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/05/27/5" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/05/27/6" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/07/22/5" + }, + { + "type": "WEB", + "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2024/05/msg00001.html" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BTJFBGHDYG5PEIFD5WSSSKSFZ2AZWC5N/" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P3I4KYS6EU6S7QZ47WFNTPVAHFIUQNEL/" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YAMJQI3Y6BHWV3CUTYBXOZONCUJNOB2Z/" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2961.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2961" + }, + { + "type": "ADVISORY", + "url": "https://security.netapp.com/advisory/ntap-20240531-0002/" + }, + { + "type": "ADVISORY", + "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0004" + }, + { + "type": "ARTICLE", + "url": "https://www.ambionics.io/blog/iconv-cve-2024-2961-p1" + }, + { + "type": "ARTICLE", + "url": "https://www.ambionics.io/blog/iconv-cve-2024-2961-p2" + }, + { + "type": "ARTICLE", + "url": "https://www.ambionics.io/blog/iconv-cve-2024-2961-p3" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-glibc-CVE-2024-33599", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-14T23:39:39Z", + "upstream": [ + "CVE-2024-33599" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "glibc", + "purl": "pkg:brew/glibc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.39" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.7.debian.tar.xz", + "apply": [ + "patches/any/CVE-2024-2961.patch", + "patches/any/CVE-2024-33599.patch", + "patches/any/CVE-2024-33600_1.patch", + "patches/any/CVE-2024-33600_2.patch", + "patches/any/CVE-2024-33601_33602.patch", + "patches/any/CVE-2025-0395.patch", + "patches/any/CVE-2025-5702.patch", + "patches/any/CVE-2025-8058.patch", + "patches/CVE-2025-15281.patch", + "patches/CVE-2026-0861.patch", + "patches/CVE-2026-0915.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "nscd: Stack-based buffer overflow in netgroup cache", + "details": "nscd: Stack-based buffer overflow in netgroup cache\n\nIf the Name Service Cache Daemon's (nscd) fixed size cache is exhausted\nby client requests then a subsequent client request for netgroup data\nmay result in a stack-based buffer overflow. This flaw was introduced\nin glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/07/22/5" + }, + { + "type": "WEB", + "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/33xxx/CVE-2024-33599.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33599" + }, + { + "type": "ADVISORY", + "url": "https://security.netapp.com/advisory/ntap-20240524-0011/" + }, + { + "type": "ADVISORY", + "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0005" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-glibc-CVE-2024-33600", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-14T23:39:39Z", + "upstream": [ + "CVE-2024-33600" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "glibc", + "purl": "pkg:brew/glibc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.39" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.7.debian.tar.xz", + "apply": [ + "patches/any/CVE-2024-2961.patch", + "patches/any/CVE-2024-33599.patch", + "patches/any/CVE-2024-33600_1.patch", + "patches/any/CVE-2024-33600_2.patch", + "patches/any/CVE-2024-33601_33602.patch", + "patches/any/CVE-2025-0395.patch", + "patches/any/CVE-2025-5702.patch", + "patches/any/CVE-2025-8058.patch", + "patches/CVE-2025-15281.patch", + "patches/CVE-2026-0861.patch", + "patches/CVE-2026-0915.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "nscd: Null pointer crashes after notfound response", + "details": "nscd: Null pointer crashes after notfound response\n\nIf the Name Service Cache Daemon's (nscd) cache fails to add a not-found\nnetgroup response to the cache, the client request can result in a null\npointer dereference. This flaw was introduced in glibc 2.15 when the\ncache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/07/22/5" + }, + { + "type": "WEB", + "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/33xxx/CVE-2024-33600.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33600" + }, + { + "type": "ADVISORY", + "url": "https://security.netapp.com/advisory/ntap-20240524-0013/" + }, + { + "type": "ADVISORY", + "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0006" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-glibc-CVE-2024-33601", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-14T23:39:39Z", + "upstream": [ + "CVE-2024-33601" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "glibc", + "purl": "pkg:brew/glibc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.39" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.7.debian.tar.xz", + "apply": [ + "patches/any/CVE-2024-2961.patch", + "patches/any/CVE-2024-33599.patch", + "patches/any/CVE-2024-33600_1.patch", + "patches/any/CVE-2024-33600_2.patch", + "patches/any/CVE-2024-33601_33602.patch", + "patches/any/CVE-2025-0395.patch", + "patches/any/CVE-2025-5702.patch", + "patches/any/CVE-2025-8058.patch", + "patches/CVE-2025-15281.patch", + "patches/CVE-2026-0861.patch", + "patches/CVE-2026-0915.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "nscd: netgroup cache may terminate daemon on memory allocation failure", + "details": "nscd: netgroup cache may terminate daemon on memory allocation failure\n\nThe Name Service Cache Daemon's (nscd) netgroup cache uses xmalloc or\nxrealloc and these functions may terminate the process due to a memory\nallocation failure resulting in a denial of service to the clients. The\nflaw was introduced in glibc 2.15 when the cache was added to nscd.\n\nThis vulnerability is only present in the nscd binary.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2024/07/22/5" + }, + { + "type": "WEB", + "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2024/06/msg00026.html" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/33xxx/CVE-2024-33601.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33601" + }, + { + "type": "ADVISORY", + "url": "https://security.netapp.com/advisory/ntap-20240524-0014/" + }, + { + "type": "ADVISORY", + "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2024-0007" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-glibc-CVE-2025-0395", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-14T23:39:39Z", + "upstream": [ + "CVE-2025-0395" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "glibc", + "purl": "pkg:brew/glibc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.39" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.7.debian.tar.xz", + "apply": [ + "patches/any/CVE-2024-2961.patch", + "patches/any/CVE-2024-33599.patch", + "patches/any/CVE-2024-33600_1.patch", + "patches/any/CVE-2024-33600_2.patch", + "patches/any/CVE-2024-33601_33602.patch", + "patches/any/CVE-2025-0395.patch", + "patches/any/CVE-2025-5702.patch", + "patches/any/CVE-2025-8058.patch", + "patches/CVE-2025-15281.patch", + "patches/CVE-2026-0861.patch", + "patches/CVE-2026-0915.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "When the assert() function in the GNU C Library versions 2.13 to 2.40 fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/01/22/4" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/01/23/2" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/04/13/1" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/04/24/7" + }, + { + "type": "WEB", + "url": "https://cert-portal.siemens.com/productcert/html/ssa-398330.html" + }, + { + "type": "WEB", + "url": "https://cert-portal.siemens.com/productcert/html/ssa-577017.html" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00039.html" + }, + { + "type": "WEB", + "url": "https://sourceware.org/pipermail/libc-announce/2025/000044.html" + }, + { + "type": "WEB", + "url": "https://www.openwall.com/lists/oss-security/2025/01/22/4" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/0xxx/CVE-2025-0395.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0395" + }, + { + "type": "ADVISORY", + "url": "https://security.netapp.com/advisory/ntap-20250228-0006/" + }, + { + "type": "ADVISORY", + "url": "https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2025-0001" + }, + { + "type": "REPORT", + "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=32582" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-glibc-CVE-2025-15281", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-14T23:39:39Z", + "upstream": [ + "CVE-2025-15281" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "glibc", + "purl": "pkg:brew/glibc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.39" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.7.debian.tar.xz", + "apply": [ + "patches/any/CVE-2024-2961.patch", + "patches/any/CVE-2024-33599.patch", + "patches/any/CVE-2024-33600_1.patch", + "patches/any/CVE-2024-33600_2.patch", + "patches/any/CVE-2024-33601_33602.patch", + "patches/any/CVE-2025-0395.patch", + "patches/any/CVE-2025-5702.patch", + "patches/any/CVE-2025-8058.patch", + "patches/CVE-2025-15281.patch", + "patches/CVE-2026-0861.patch", + "patches/CVE-2026-0915.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "wordexp with WRDE_REUSE and WRDE_APPEND may return uninitialized memory", + "details": "Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/01/20/3" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15281.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15281" + }, + { + "type": "REPORT", + "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33814" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-glibc-CVE-2025-5702", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-14T23:39:39Z", + "upstream": [ + "CVE-2025-5702" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "glibc", + "purl": "pkg:brew/glibc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.39" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.7.debian.tar.xz", + "apply": [ + "patches/any/CVE-2024-2961.patch", + "patches/any/CVE-2024-33599.patch", + "patches/any/CVE-2024-33600_1.patch", + "patches/any/CVE-2024-33600_2.patch", + "patches/any/CVE-2024-33601_33602.patch", + "patches/any/CVE-2025-0395.patch", + "patches/any/CVE-2025-5702.patch", + "patches/any/CVE-2025-8058.patch", + "patches/CVE-2025-15281.patch", + "patches/CVE-2026-0861.patch", + "patches/CVE-2026-0915.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "The strcmp implementation optimized for the Power10 processor in the GNU C Library version 2.39 and later writes to vector registers v20 to v31 without saving contents from the caller (those registers are defined as non-volatile registers by the powerpc64le ABI), resulting in overwriting of its contents and potentially altering control flow of the caller, or leaking the input strings to the function to other parts of the program.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L" + } + ], + "references": [ + { + "type": "REPORT", + "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33056" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-glibc-CVE-2025-8058", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-14T23:39:39Z", + "upstream": [ + "CVE-2025-8058" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "glibc", + "purl": "pkg:brew/glibc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.39" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.7.debian.tar.xz", + "apply": [ + "patches/any/CVE-2024-2961.patch", + "patches/any/CVE-2024-33599.patch", + "patches/any/CVE-2024-33600_1.patch", + "patches/any/CVE-2024-33600_2.patch", + "patches/any/CVE-2024-33601_33602.patch", + "patches/any/CVE-2025-0395.patch", + "patches/any/CVE-2025-5702.patch", + "patches/any/CVE-2025-8058.patch", + "patches/CVE-2025-15281.patch", + "patches/CVE-2026-0861.patch", + "patches/CVE-2026-0915.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "The regcomp function in the GNU C library version from 2.4 to 2.41 is \nsubject to a double free if some previous allocation fails. It can be \naccomplished either by a malloc failure or by using an interposed malloc\n that injects random malloc failures. The double free can allow buffer \nmanipulation depending of how the regex is constructed. This issue \naffects all architectures and ABIs supported by the GNU C library.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2025/07/23/1" + }, + { + "type": "WEB", + "url": "https://sourceware.org/git/?p=glibc.git;a=commit;h=3ff17af18c38727b88d9115e536c069e6b5d601f" + }, + { + "type": "WEB", + "url": "https://www.gnu.org/software/libc/" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8058.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8058" + }, + { + "type": "REPORT", + "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33185" + }, + { + "type": "PACKAGE", + "url": "https://sourceware.org/git/?p=glibc.git" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-glibc-CVE-2026-0861", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-14T23:39:39Z", + "upstream": [ + "CVE-2026-0861" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "glibc", + "purl": "pkg:brew/glibc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.39" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.7.debian.tar.xz", + "apply": [ + "patches/any/CVE-2024-2961.patch", + "patches/any/CVE-2024-33599.patch", + "patches/any/CVE-2024-33600_1.patch", + "patches/any/CVE-2024-33600_2.patch", + "patches/any/CVE-2024-33601_33602.patch", + "patches/any/CVE-2025-0395.patch", + "patches/any/CVE-2025-5702.patch", + "patches/any/CVE-2025-8058.patch", + "patches/CVE-2025-15281.patch", + "patches/CVE-2026-0861.patch", + "patches/CVE-2026-0915.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "Integer overflow in memalign leads to heap corruption", + "details": "Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\n\nNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.\n\nTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/01/16/5" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0861.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0861" + }, + { + "type": "ADVISORY", + "url": "https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001" + }, + { + "type": "REPORT", + "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33796" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-glibc-CVE-2026-0915", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-14T23:39:39Z", + "upstream": [ + "CVE-2026-0915" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "glibc", + "purl": "pkg:brew/glibc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.39" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/g/glibc/glibc_2.39-0ubuntu8.7.debian.tar.xz", + "apply": [ + "patches/any/CVE-2024-2961.patch", + "patches/any/CVE-2024-33599.patch", + "patches/any/CVE-2024-33600_1.patch", + "patches/any/CVE-2024-33600_2.patch", + "patches/any/CVE-2024-33601_33602.patch", + "patches/any/CVE-2025-0395.patch", + "patches/any/CVE-2025-5702.patch", + "patches/any/CVE-2025-8058.patch", + "patches/CVE-2025-15281.patch", + "patches/CVE-2026-0861.patch", + "patches/CVE-2026-0915.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler", + "details": "Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "references": [ + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2026/01/16/6" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/0xxx/CVE-2026-0915.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0915" + }, + { + "type": "REPORT", + "url": "https://sourceware.org/bugzilla/show_bug.cgi?id=33802" + } + ] + } + ], + "libquicktime": [ + { + "schema_version": "1.7.3", + "id": "BREW-libquicktime-CVE-2016-2399", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2016-2399" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libquicktime", + "purl": "pkg:brew/libquicktime" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.4_3" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", + "apply": [ + "patches/CVE-2016-2399.patch", + "patches/CVE-2017-9122_et_al.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://www.exploit-db.com/exploits/39487/" + }, + { + "type": "ADVISORY", + "url": "http://www.debian.org/security/2017/dsa-3800" + }, + { + "type": "ADVISORY", + "url": "http://www.securityfocus.com/bid/95880" + }, + { + "type": "EVIDENCE", + "url": "http://www.nemux.org/2016/02/23/libquicktime-1-2-4/" + }, + { + "type": "EVIDENCE", + "url": "https://packetstormsecurity.com/files/135899/libquicktime-1.2.4-Integer-Overflow.html" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-libquicktime-CVE-2017-9122", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2017-9122" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libquicktime", + "purl": "pkg:brew/libquicktime" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.4_4" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", + "apply": [ + "patches/CVE-2016-2399.patch", + "patches/CVE-2017-9122_et_al.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "The quicktime_read_moov function in moov.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted mp4 file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://usn.ubuntu.com/4545-1/" + }, + { + "type": "ADVISORY", + "url": "https://www.exploit-db.com/exploits/42148/" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-libquicktime-CVE-2017-9123", + "published": "2026-07-14T23:39:39Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2017-9123" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libquicktime", + "purl": "pkg:brew/libquicktime" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.4_4" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", + "apply": [ + "patches/CVE-2016-2399.patch", + "patches/CVE-2017-9122_et_al.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (invalid memory read and application crash) via a crafted mp4 file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://usn.ubuntu.com/4545-1/" + }, + { + "type": "ADVISORY", + "url": "https://www.exploit-db.com/exploits/42148/" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-libquicktime-CVE-2017-9124", + "published": "2026-07-14T23:39:39Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2017-9124" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libquicktime", + "purl": "pkg:brew/libquicktime" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.4_4" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", + "apply": [ + "patches/CVE-2016-2399.patch", + "patches/CVE-2017-9122_et_al.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "The quicktime_match_32 function in util.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via a crafted mp4 file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://usn.ubuntu.com/4545-1/" + }, + { + "type": "ADVISORY", + "url": "https://www.exploit-db.com/exploits/42148/" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-libquicktime-CVE-2017-9125", + "published": "2026-07-14T23:39:39Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2017-9125" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libquicktime", + "purl": "pkg:brew/libquicktime" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.4_4" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", + "apply": [ + "patches/CVE-2016-2399.patch", + "patches/CVE-2017-9122_et_al.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "The lqt_frame_duration function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted mp4 file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://usn.ubuntu.com/4545-1/" + }, + { + "type": "ADVISORY", + "url": "https://www.exploit-db.com/exploits/42148/" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-libquicktime-CVE-2017-9126", + "published": "2026-07-14T23:39:39Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2017-9126" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libquicktime", + "purl": "pkg:brew/libquicktime" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.4_4" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", + "apply": [ + "patches/CVE-2016-2399.patch", + "patches/CVE-2017-9122_et_al.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "The quicktime_read_dref_table function in dref.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://usn.ubuntu.com/4545-1/" + }, + { + "type": "ADVISORY", + "url": "https://www.exploit-db.com/exploits/42148/" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-libquicktime-CVE-2017-9127", + "published": "2026-07-14T23:39:39Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2017-9127" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libquicktime", + "purl": "pkg:brew/libquicktime" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.4_4" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", + "apply": [ + "patches/CVE-2016-2399.patch", + "patches/CVE-2017-9122_et_al.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "The quicktime_user_atoms_read_atom function in useratoms.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted mp4 file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://usn.ubuntu.com/4545-1/" + }, + { + "type": "ADVISORY", + "url": "https://www.exploit-db.com/exploits/42148/" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-libquicktime-CVE-2017-9128", + "published": "2026-07-14T23:39:39Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2017-9128" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libquicktime", + "purl": "pkg:brew/libquicktime" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.2.4_4" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://deb.debian.org/debian/pool/main/libq/libquicktime/libquicktime_1.2.4-12.debian.tar.xz", + "apply": [ + "patches/CVE-2016-2399.patch", + "patches/CVE-2017-9122_et_al.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "The quicktime_video_width function in lqt_quicktime.c in libquicktime 1.2.4 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted mp4 file.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://usn.ubuntu.com/4545-1/" + }, + { + "type": "ADVISORY", + "url": "https://www.exploit-db.com/exploits/42148/" + } + ] + } + ], + "libssh2": [ + { + "schema_version": "1.7.3", + "id": "BREW-libssh2-CVE-2025-15661", + "published": "2026-07-18T04:02:33Z", + "modified": "2026-07-18T04:02:33Z", + "upstream": [ + "CVE-2025-15661" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libssh2", + "purl": "pkg:brew/libssh2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.1_3" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "file": "Patches/libssh2/CVE-2025-15661.patch" + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "libssh2 - Heap Buffer Over-read via sftp_symlink() in sftp.c", + "details": "libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server or man-in-the-middle attacker to disclose heap memory contents or cause a crash by sending a crafted SSH_FXP_NAME response. Attackers can supply a link_len value larger than the actual packet data in SSH_FXP_NAME responses for SFTP READLINK and REALPATH operations, triggering a heap buffer over-read of up to target_len minus one bytes due to the missing validation of available packet buffer size before the memcpy operation.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15661.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15661" + }, + { + "type": "ADVISORY", + "url": "https://www.vulncheck.com/advisories/libssh2-heap-buffer-over-read-via-sftp-symlink-in-sftp-c" + }, + { + "type": "REPORT", + "url": "https://github.com/libssh2/libssh2/pull/1705" + }, + { + "type": "REPORT", + "url": "https://github.com/libssh2/libssh2/pull/1717" + }, + { + "type": "FIX", + "url": "https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d" + }, + { + "type": "PACKAGE", + "url": "https://github.com/libssh2/libssh2" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-libssh2-CVE-2026-55199", + "published": "2026-07-18T04:02:33Z", + "modified": "2026-07-18T04:02:33Z", + "upstream": [ + "CVE-2026-55199" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libssh2", + "purl": "pkg:brew/libssh2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.1_3" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4.patch?full_index=1" + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler", + "details": "libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSH_MSG_EXT_INFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can set nr_extensions to 0xFFFFFFFF during key exchange, causing the client to spin in a tight CPU loop for over 60 seconds because return values from _libssh2_get_string() are unchecked and the session timeout does not apply to CPU-bound loops.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55199.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55199" + }, + { + "type": "ADVISORY", + "url": "https://www.vulncheck.com/advisories/libssh2-pre-authentication-dos-via-ssh-msg-ext-info-handler" + }, + { + "type": "REPORT", + "url": "https://github.com/libssh2/libssh2/pull/1864" + }, + { + "type": "FIX", + "url": "https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4" + }, + { + "type": "PACKAGE", + "url": "https://github.com/libssh2/libssh2" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-libssh2-CVE-2026-55200", + "published": "2026-07-18T04:02:33Z", + "modified": "2026-07-18T04:02:33Z", + "upstream": [ + "CVE-2026-55200" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libssh2", + "purl": "pkg:brew/libssh2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.1_3" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "file": "Patches/libssh2/CVE-2026-55200.patch" + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c", + "details": "libssh2 through 1.11.1, fixed in commit 7acf3df contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field. Remote attackers can send crafted SSH packets with excessively large packet_length values to corrupt heap memory and achieve remote code execution.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55200.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55200" + }, + { + "type": "ADVISORY", + "url": "https://www.vulncheck.com/advisories/libssh2-out-of-bounds-write-via-unchecked-packet-length-in-transport-c" + }, + { + "type": "REPORT", + "url": "https://github.com/libssh2/libssh2/pull/2052" + }, + { + "type": "FIX", + "url": "https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8" + }, + { + "type": "PACKAGE", + "url": "https://github.com/libssh2/libssh2" + }, + { + "type": "EVIDENCE", + "url": "https://web.archive.org/web/20260623211210/https://github.com/bikini/exploitarium/tree/main/libssh2-cve-2026-55200-poc" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-libssh2-CVE-2026-58050", + "published": "2026-07-18T04:02:33Z", + "modified": "2026-07-18T04:02:33Z", + "upstream": [ + "CVE-2026-58050" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libssh2", + "purl": "pkg:brew/libssh2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.1_3" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "file": "Patches/libssh2/CVE-2026-58050.patch" + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "libssh2 - Integer Overflow in publickey Subsystem Attribute Allocation", + "details": "libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation num_attrs * sizeof(libssh2_publickey_attribute) without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffer. A malicious SSH server can then drive the attribute-parsing loop to write past the allocation, causing a heap buffer overflow in a connecting libssh2 client.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/libssh2/libssh2/blob/master/src/publickey.c" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58050.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58050" + }, + { + "type": "ADVISORY", + "url": "https://www.vulncheck.com/advisories/libssh2-integer-overflow-in-publickey-subsystem-attribute-allocation" + }, + { + "type": "EVIDENCE", + "url": "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-libssh2-CVE-2026-58051", + "published": "2026-07-18T04:02:33Z", + "modified": "2026-07-18T04:02:33Z", + "upstream": [ + "CVE-2026-58051" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libssh2", + "purl": "pkg:brew/libssh2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.1_3" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a.patch?full_index=1" + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "libssh2 - Free of Uninitialized Pointer in publickey List Cleanup", + "details": "libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/libssh2/libssh2/blob/master/src/publickey.c" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58051.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58051" + }, + { + "type": "ADVISORY", + "url": "https://www.vulncheck.com/advisories/libssh2-free-of-uninitialized-pointer-in-publickey-list-cleanup" + }, + { + "type": "EVIDENCE", + "url": "https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-libssh2-CVE-2026-7598", + "published": "2026-07-18T04:02:33Z", + "modified": "2026-07-18T04:02:33Z", + "upstream": [ + "CVE-2026-7598" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libssh2", + "purl": "pkg:brew/libssh2" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.1_3" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1.patch?full_index=1" + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "libssh2 userauth.c userauth_password integer overflow", + "details": "A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be launched remotely. The name of the patch is 256d04b60d80bf1190e96b0ad1e91b2174d744b1. A patch should be applied to remediate this issue.", + "severity": [ + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/libssh2/libssh2/" + }, + { + "type": "WEB", + "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-7598.json" + }, + { + "type": "ADVISORY", + "url": "https://access.redhat.com/errata/RHSA-2026:16736" + }, + { + "type": "ADVISORY", + "url": "https://access.redhat.com/errata/RHSA-2026:7021" + }, + { + "type": "ADVISORY", + "url": "https://access.redhat.com/security/cve/CVE-2026-7598" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/7xxx/CVE-2026-7598.json" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7598" + }, + { + "type": "ADVISORY", + "url": "https://vuldb.com/submit/805564" + }, + { + "type": "ADVISORY", + "url": "https://vuldb.com/vuln/360555" + }, + { + "type": "REPORT", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2464597" + }, + { + "type": "REPORT", + "url": "https://vuldb.com/vuln/360555/cti" + }, + { + "type": "FIX", + "url": "https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1" + }, + { + "type": "FIX", + "url": "https://github.com/libssh2/libssh2/pull/1858" + } + ] + } + ], + "libtomcrypt": [ + { + "schema_version": "1.7.3", + "id": "BREW-libtomcrypt-CVE-2019-17362", + "published": "2026-07-27T07:36:55Z", + "modified": "2026-07-28T07:20:23Z", + "upstream": [ + "CVE-2019-17362" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "libtomcrypt", + "purl": "pkg:brew/libtomcrypt" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.18.2_1" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://github.com/libtom/libtomcrypt/commit/64d1153e5a515740ab56f39c46baf4cf6991a9d3.patch?full_index=1" + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "In LibTomCrypt through 1.18.2, the der_decode_utf8_string function (in der_decode_utf8_string.c) does not properly detect certain invalid UTF-8 sequences. This allows context-dependent attackers to cause a denial of service (out-of-bounds read and crash) or read information from other memory locations via carefully crafted DER-encoded data.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00020.html" + }, + { + "type": "WEB", + "url": "http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00041.html" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/47YP5SXQ4RY6KMTK2HI5ZZR244XKRMCZ/" + }, + { + "type": "WEB", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YU5OMCY3PX54YVI4FMNDEENHDJZJ3RJW/" + }, + { + "type": "ADVISORY", + "url": "https://lists.debian.org/debian-lts-announce/2019/10/msg00010.html" + }, + { + "type": "REPORT", + "url": "https://vuldb.com/?id.142995" + }, + { + "type": "FIX", + "url": "https://github.com/libtom/libtomcrypt/pull/508" + }, + { + "type": "EVIDENCE", + "url": "https://github.com/libtom/libtomcrypt/issues/507" + } + ] + } + ], + "lrzsz": [ + { + "schema_version": "1.7.3", + "id": "BREW-lrzsz-CVE-2018-10195", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-14T23:39:39Z", + "upstream": [ + "CVE-2018-10195" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "lrzsz", + "purl": "pkg:brew/lrzsz" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "0.12.20_1" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "url": "https://raw.githubusercontent.com/macports/macports-ports/2319730/comms/lrzsz/files/patch-CVE-2018-10195.diff" + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "lrzsz before version 0.12.21~rc can leak information to the receiving side due to an incorrect length check in the function zsdata that causes a size_t to wrap around.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-April/003955.html?_ga=2.81625751.1026327980.1622040648-1950393542.1547130931" + }, + { + "type": "ADVISORY", + "url": "https://lists.suse.com/pipermail/sle-security-updates/2018-April/003956.html?_ga=2.81625751.1026327980.1622040648-1950393542.1547130931" + }, + { + "type": "ADVISORY", + "url": "http://www.ohse.de/uwe/software/lrzsz.html" + }, + { + "type": "REPORT", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1572058" + }, + { + "type": "REPORT", + "url": "https://lists.debian.org/debian-lts-announce/2022/01/msg00027.html" + } + ] + } + ], + "nvi": [ + { + "schema_version": "1.7.3", + "id": "BREW-nvi-CVE-2015-2305", + "published": "2026-07-14T23:39:39Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2015-2305" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "nvi", + "purl": "pkg:brew/nvi" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.81.6_3" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "backport", + "url": "https://deb.debian.org/debian/pool/main/n/nvi/nvi_1.81.6-17.debian.tar.xz", + "apply": [ + "patches/03db4.patch", + "patches/19include_term_h.patch", + "patches/20glibc_has_grantpt.patch", + "patches/24fallback_to_dumb_term.patch", + "patches/26trailing_tab_segv.patch", + "patches/27support_C_locale.patch", + "patches/31regex_heap_overflow.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "Integer overflow in the regcomp implementation in the Henry Spencer BSD regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in NetBSD through 6.1.5 and other products, might allow context-dependent attackers to execute arbitrary code via a large regular expression that leads to a heap-based buffer overflow.", + "references": [ + { + "type": "ADVISORY", + "url": "http://blog.clamav.net/2015/04/clamav-0987-has-been-released.html" + }, + { + "type": "ADVISORY", + "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html" + }, + { + "type": "ADVISORY", + "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html" + }, + { + "type": "ADVISORY", + "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html" + }, + { + "type": "ADVISORY", + "url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html" + }, + { + "type": "ADVISORY", + "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html" + }, + { + "type": "ADVISORY", + "url": "http://marc.info/?l=bugtraq&m=143403519711434&w=2" + }, + { + "type": "ADVISORY", + "url": "http://openwall.com/lists/oss-security/2015/02/07/14" + }, + { + "type": "ADVISORY", + "url": "http://openwall.com/lists/oss-security/2015/03/11/8" + }, + { + "type": "ADVISORY", + "url": "http://php.net/ChangeLog-5.php" + }, + { + "type": "ADVISORY", + "url": "http://rhn.redhat.com/errata/RHSA-2015-1053.html" + }, + { + "type": "ADVISORY", + "url": "http://rhn.redhat.com/errata/RHSA-2015-1066.html" + }, + { + "type": "ADVISORY", + "url": "http://www.debian.org/security/2015/dsa-3195" + }, + { + "type": "ADVISORY", + "url": "http://www.kb.cert.org/vuls/id/695940" + }, + { + "type": "ADVISORY", + "url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html" + }, + { + "type": "ADVISORY", + "url": "http://www.securityfocus.com/bid/72611" + }, + { + "type": "ADVISORY", + "url": "http://www.securitytracker.com/id/1031947" + }, + { + "type": "ADVISORY", + "url": "http://www.ubuntu.com/usn/USN-2572-1" + }, + { + "type": "ADVISORY", + "url": "http://www.ubuntu.com/usn/USN-2594-1" + }, + { + "type": "ADVISORY", + "url": "https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/" + }, + { + "type": "ADVISORY", + "url": "https://support.apple.com/HT205267" + }, + { + "type": "ARTICLE", + "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html" + }, + { + "type": "ARTICLE", + "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00005.html" + }, + { + "type": "ARTICLE", + "url": "http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00026.html" + }, + { + "type": "ARTICLE", + "url": "http://lists.opensuse.org/opensuse-updates/2015-04/msg00002.html" + }, + { + "type": "ARTICLE", + "url": "http://lists.opensuse.org/opensuse-updates/2015-05/msg00024.html" + }, + { + "type": "ARTICLE", + "url": "http://marc.info/?l=bugtraq&m=143403519711434&w=2" + }, + { + "type": "ARTICLE", + "url": "http://openwall.com/lists/oss-security/2015/02/07/14" + }, + { + "type": "ARTICLE", + "url": "http://openwall.com/lists/oss-security/2015/03/11/8" + }, + { + "type": "EVIDENCE", + "url": "https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/" + }, + { + "type": "WEB", + "url": "http://www.kb.cert.org/vuls/id/695940" + } + ] + } + ], + "unzip": [ + { + "schema_version": "1.7.3", + "id": "BREW-unzip-CVE-2014-8139", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2014-8139" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "unzip", + "purl": "pkg:brew/unzip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0_1" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", + "apply": [ + "patches/01-manpages-in-section-1-not-in-section-1l.patch", + "patches/02-this-is-debian-unzip.patch", + "patches/03-include-unistd-for-kfreebsd.patch", + "patches/04-handle-pkware-verification-bit.patch", + "patches/05-fix-uid-gid-handling.patch", + "patches/06-initialize-the-symlink-flag.patch", + "patches/07-increase-size-of-cfactorstr.patch", + "patches/08-allow-greater-hostver-values.patch", + "patches/09-cve-2014-8139-crc-overflow.patch", + "patches/10-cve-2014-8140-test-compr-eb.patch", + "patches/11-cve-2014-8141-getzip64data.patch", + "patches/12-cve-2014-9636-test-compr-eb.patch", + "patches/13-remove-build-date.patch", + "patches/14-cve-2015-7696.patch", + "patches/15-cve-2015-7697.patch", + "patches/16-fix-integer-underflow-csiz-decrypted.patch", + "patches/17-restore-unix-timestamps-accurately.patch", + "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", + "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", + "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", + "patches/20-unzip60-alt-iconv-utf8.patch", + "patches/21-fix-warning-messages-on-big-files.patch", + "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", + "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", + "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", + "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", + "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", + "patches/27-zipgrep-avoid-test-errors.patch", + "patches/28-cve-2022-0529-and-cve-2022-0530.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "http://www.ocert.org/advisories/ocert-2014-011.html" + }, + { + "type": "ADVISORY", + "url": "http://www.securitytracker.com/id/1031433" + }, + { + "type": "ADVISORY", + "url": "https://access.redhat.com/errata/RHSA-2015:0700" + }, + { + "type": "ADVISORY", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174844" + }, + { + "type": "FIX", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174844" + }, + { + "type": "REPORT", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174844" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-unzip-CVE-2014-8140", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2014-8140" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "unzip", + "purl": "pkg:brew/unzip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0_1" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", + "apply": [ + "patches/01-manpages-in-section-1-not-in-section-1l.patch", + "patches/02-this-is-debian-unzip.patch", + "patches/03-include-unistd-for-kfreebsd.patch", + "patches/04-handle-pkware-verification-bit.patch", + "patches/05-fix-uid-gid-handling.patch", + "patches/06-initialize-the-symlink-flag.patch", + "patches/07-increase-size-of-cfactorstr.patch", + "patches/08-allow-greater-hostver-values.patch", + "patches/09-cve-2014-8139-crc-overflow.patch", + "patches/10-cve-2014-8140-test-compr-eb.patch", + "patches/11-cve-2014-8141-getzip64data.patch", + "patches/12-cve-2014-9636-test-compr-eb.patch", + "patches/13-remove-build-date.patch", + "patches/14-cve-2015-7696.patch", + "patches/15-cve-2015-7697.patch", + "patches/16-fix-integer-underflow-csiz-decrypted.patch", + "patches/17-restore-unix-timestamps-accurately.patch", + "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", + "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", + "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", + "patches/20-unzip60-alt-iconv-utf8.patch", + "patches/21-fix-warning-messages-on-big-files.patch", + "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", + "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", + "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", + "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", + "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", + "patches/27-zipgrep-avoid-test-errors.patch", + "patches/28-cve-2022-0529-and-cve-2022-0530.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "http://www.ocert.org/advisories/ocert-2014-011.html" + }, + { + "type": "ADVISORY", + "url": "http://www.securitytracker.com/id/1031433" + }, + { + "type": "ADVISORY", + "url": "https://access.redhat.com/errata/RHSA-2015:0700" + }, + { + "type": "ADVISORY", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174851" + }, + { + "type": "REPORT", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174851" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-unzip-CVE-2014-8141", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2014-8141" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "unzip", + "purl": "pkg:brew/unzip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0_1" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", + "apply": [ + "patches/01-manpages-in-section-1-not-in-section-1l.patch", + "patches/02-this-is-debian-unzip.patch", + "patches/03-include-unistd-for-kfreebsd.patch", + "patches/04-handle-pkware-verification-bit.patch", + "patches/05-fix-uid-gid-handling.patch", + "patches/06-initialize-the-symlink-flag.patch", + "patches/07-increase-size-of-cfactorstr.patch", + "patches/08-allow-greater-hostver-values.patch", + "patches/09-cve-2014-8139-crc-overflow.patch", + "patches/10-cve-2014-8140-test-compr-eb.patch", + "patches/11-cve-2014-8141-getzip64data.patch", + "patches/12-cve-2014-9636-test-compr-eb.patch", + "patches/13-remove-build-date.patch", + "patches/14-cve-2015-7696.patch", + "patches/15-cve-2015-7697.patch", + "patches/16-fix-integer-underflow-csiz-decrypted.patch", + "patches/17-restore-unix-timestamps-accurately.patch", + "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", + "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", + "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", + "patches/20-unzip60-alt-iconv-utf8.patch", + "patches/21-fix-warning-messages-on-big-files.patch", + "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", + "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", + "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", + "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", + "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", + "patches/27-zipgrep-avoid-test-errors.patch", + "patches/28-cve-2022-0529-and-cve-2022-0530.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "http://www.ocert.org/advisories/ocert-2014-011.html" + }, + { + "type": "ADVISORY", + "url": "http://www.securitytracker.com/id/1031433" + }, + { + "type": "ADVISORY", + "url": "https://access.redhat.com/errata/RHSA-2015:0700" + }, + { + "type": "ADVISORY", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174856" + }, + { + "type": "FIX", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174856" + }, + { + "type": "REPORT", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174856" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-unzip-CVE-2014-9636", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2014-9636" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "unzip", + "purl": "pkg:brew/unzip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0_1" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", + "apply": [ + "patches/01-manpages-in-section-1-not-in-section-1l.patch", + "patches/02-this-is-debian-unzip.patch", + "patches/03-include-unistd-for-kfreebsd.patch", + "patches/04-handle-pkware-verification-bit.patch", + "patches/05-fix-uid-gid-handling.patch", + "patches/06-initialize-the-symlink-flag.patch", + "patches/07-increase-size-of-cfactorstr.patch", + "patches/08-allow-greater-hostver-values.patch", + "patches/09-cve-2014-8139-crc-overflow.patch", + "patches/10-cve-2014-8140-test-compr-eb.patch", + "patches/11-cve-2014-8141-getzip64data.patch", + "patches/12-cve-2014-9636-test-compr-eb.patch", + "patches/13-remove-build-date.patch", + "patches/14-cve-2015-7696.patch", + "patches/15-cve-2015-7697.patch", + "patches/16-fix-integer-underflow-csiz-decrypted.patch", + "patches/17-restore-unix-timestamps-accurately.patch", + "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", + "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", + "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", + "patches/20-unzip60-alt-iconv-utf8.patch", + "patches/21-fix-warning-messages-on-big-files.patch", + "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", + "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", + "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", + "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", + "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", + "patches/27-zipgrep-avoid-test-errors.patch", + "patches/28-cve-2022-0529-and-cve-2022-0530.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "unzip 6.0 allows remote attackers to cause a denial of service (out-of-bounds read or write and crash) via an extra field with an uncompressed size smaller than the compressed field size in a zip archive that advertises STORED method compression.", + "references": [ + { + "type": "ADVISORY", + "url": "http://secunia.com/advisories/62738" + }, + { + "type": "ADVISORY", + "url": "http://secunia.com/advisories/62751" + }, + { + "type": "ADVISORY", + "url": "http://www.debian.org/security/2015/dsa-3152" + }, + { + "type": "ADVISORY", + "url": "http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450" + }, + { + "type": "ADVISORY", + "url": "http://www.ubuntu.com/usn/USN-2489-1" + }, + { + "type": "ADVISORY", + "url": "https://security.gentoo.org/glsa/201611-01" + }, + { + "type": "FIX", + "url": "http://www.info-zip.org/phpBB3/viewtopic.php?f=7&t=450" + }, + { + "type": "WEB", + "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148792.html" + }, + { + "type": "WEB", + "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148849.html" + }, + { + "type": "WEB", + "url": "http://seclists.org/oss-sec/2014/q4/1131" + }, + { + "type": "WEB", + "url": "http://seclists.org/oss-sec/2014/q4/489" + }, + { + "type": "WEB", + "url": "http://seclists.org/oss-sec/2014/q4/496" + }, + { + "type": "WEB", + "url": "http://seclists.org/oss-sec/2015/q1/216" + }, + { + "type": "WEB", + "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/71825" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-unzip-CVE-2014-9913", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2014-9913" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "unzip", + "purl": "pkg:brew/unzip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0_3" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", + "apply": [ + "patches/01-manpages-in-section-1-not-in-section-1l.patch", + "patches/02-this-is-debian-unzip.patch", + "patches/03-include-unistd-for-kfreebsd.patch", + "patches/04-handle-pkware-verification-bit.patch", + "patches/05-fix-uid-gid-handling.patch", + "patches/06-initialize-the-symlink-flag.patch", + "patches/07-increase-size-of-cfactorstr.patch", + "patches/08-allow-greater-hostver-values.patch", + "patches/09-cve-2014-8139-crc-overflow.patch", + "patches/10-cve-2014-8140-test-compr-eb.patch", + "patches/11-cve-2014-8141-getzip64data.patch", + "patches/12-cve-2014-9636-test-compr-eb.patch", + "patches/13-remove-build-date.patch", + "patches/14-cve-2015-7696.patch", + "patches/15-cve-2015-7697.patch", + "patches/16-fix-integer-underflow-csiz-decrypted.patch", + "patches/17-restore-unix-timestamps-accurately.patch", + "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", + "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", + "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", + "patches/20-unzip60-alt-iconv-utf8.patch", + "patches/21-fix-warning-messages-on-big-files.patch", + "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", + "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", + "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", + "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", + "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", + "patches/27-zipgrep-avoid-test-errors.patch", + "patches/28-cve-2022-0529-and-cve-2022-0530.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "Buffer overflow in the list_files function in list.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via vectors related to the compression method.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "http://www.openwall.com/lists/oss-security/2014/11/03/5" + }, + { + "type": "ADVISORY", + "url": "http://www.openwall.com/lists/oss-security/2016/12/05/13" + }, + { + "type": "ADVISORY", + "url": "http://www.openwall.com/lists/oss-security/2016/12/05/19" + }, + { + "type": "ADVISORY", + "url": "http://www.openwall.com/lists/oss-security/2016/12/05/20" + }, + { + "type": "ADVISORY", + "url": "http://www.securityfocus.com/bid/95081" + }, + { + "type": "ADVISORY", + "url": "https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750" + }, + { + "type": "ARTICLE", + "url": "http://www.openwall.com/lists/oss-security/2014/11/03/5" + }, + { + "type": "ARTICLE", + "url": "http://www.openwall.com/lists/oss-security/2016/12/05/13" + }, + { + "type": "ARTICLE", + "url": "http://www.openwall.com/lists/oss-security/2016/12/05/19" + }, + { + "type": "ARTICLE", + "url": "http://www.openwall.com/lists/oss-security/2016/12/05/20" + }, + { + "type": "REPORT", + "url": "https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-unzip-CVE-2015-7696", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2015-7696" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "unzip", + "purl": "pkg:brew/unzip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0_1" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", + "apply": [ + "patches/01-manpages-in-section-1-not-in-section-1l.patch", + "patches/02-this-is-debian-unzip.patch", + "patches/03-include-unistd-for-kfreebsd.patch", + "patches/04-handle-pkware-verification-bit.patch", + "patches/05-fix-uid-gid-handling.patch", + "patches/06-initialize-the-symlink-flag.patch", + "patches/07-increase-size-of-cfactorstr.patch", + "patches/08-allow-greater-hostver-values.patch", + "patches/09-cve-2014-8139-crc-overflow.patch", + "patches/10-cve-2014-8140-test-compr-eb.patch", + "patches/11-cve-2014-8141-getzip64data.patch", + "patches/12-cve-2014-9636-test-compr-eb.patch", + "patches/13-remove-build-date.patch", + "patches/14-cve-2015-7696.patch", + "patches/15-cve-2015-7697.patch", + "patches/16-fix-integer-underflow-csiz-decrypted.patch", + "patches/17-restore-unix-timestamps-accurately.patch", + "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", + "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", + "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", + "patches/20-unzip60-alt-iconv-utf8.patch", + "patches/21-fix-warning-messages-on-big-files.patch", + "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", + "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", + "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", + "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", + "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", + "patches/27-zipgrep-avoid-test-errors.patch", + "patches/28-cve-2022-0529-and-cve-2022-0530.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code via a crafted password-protected ZIP archive, possibly related to an Extra-Field size value.", + "references": [ + { + "type": "ADVISORY", + "url": "http://www.debian.org/security/2015/dsa-3386" + }, + { + "type": "ADVISORY", + "url": "http://www.ubuntu.com/usn/USN-2788-1" + }, + { + "type": "ADVISORY", + "url": "http://www.ubuntu.com/usn/USN-2788-2" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2015/09/07/4" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2015/09/15/6" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2015/09/21/6" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2015/10/11/5" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/76863" + }, + { + "type": "WEB", + "url": "http://www.securitytracker.com/id/1034027" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-unzip-CVE-2015-7697", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2015-7697" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "unzip", + "purl": "pkg:brew/unzip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0_1" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", + "apply": [ + "patches/01-manpages-in-section-1-not-in-section-1l.patch", + "patches/02-this-is-debian-unzip.patch", + "patches/03-include-unistd-for-kfreebsd.patch", + "patches/04-handle-pkware-verification-bit.patch", + "patches/05-fix-uid-gid-handling.patch", + "patches/06-initialize-the-symlink-flag.patch", + "patches/07-increase-size-of-cfactorstr.patch", + "patches/08-allow-greater-hostver-values.patch", + "patches/09-cve-2014-8139-crc-overflow.patch", + "patches/10-cve-2014-8140-test-compr-eb.patch", + "patches/11-cve-2014-8141-getzip64data.patch", + "patches/12-cve-2014-9636-test-compr-eb.patch", + "patches/13-remove-build-date.patch", + "patches/14-cve-2015-7696.patch", + "patches/15-cve-2015-7697.patch", + "patches/16-fix-integer-underflow-csiz-decrypted.patch", + "patches/17-restore-unix-timestamps-accurately.patch", + "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", + "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", + "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", + "patches/20-unzip60-alt-iconv-utf8.patch", + "patches/21-fix-warning-messages-on-big-files.patch", + "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", + "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", + "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", + "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", + "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", + "patches/27-zipgrep-avoid-test-errors.patch", + "patches/28-cve-2022-0529-and-cve-2022-0530.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive.", + "references": [ + { + "type": "ADVISORY", + "url": "http://www.debian.org/security/2015/dsa-3386" + }, + { + "type": "ADVISORY", + "url": "http://www.ubuntu.com/usn/USN-2788-1" + }, + { + "type": "ADVISORY", + "url": "http://www.ubuntu.com/usn/USN-2788-2" + }, + { + "type": "WEB", + "url": "http://sourceforge.net/p/infozip/patches/23/" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2015/09/07/4" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2015/09/15/6" + }, + { + "type": "WEB", + "url": "http://www.openwall.com/lists/oss-security/2015/10/11/5" + }, + { + "type": "WEB", + "url": "http://www.securityfocus.com/bid/76863" + }, + { + "type": "WEB", + "url": "http://www.securitytracker.com/id/1034027" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-unzip-CVE-2016-9844", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2016-9844" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "unzip", + "purl": "pkg:brew/unzip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0_3" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", + "apply": [ + "patches/01-manpages-in-section-1-not-in-section-1l.patch", + "patches/02-this-is-debian-unzip.patch", + "patches/03-include-unistd-for-kfreebsd.patch", + "patches/04-handle-pkware-verification-bit.patch", + "patches/05-fix-uid-gid-handling.patch", + "patches/06-initialize-the-symlink-flag.patch", + "patches/07-increase-size-of-cfactorstr.patch", + "patches/08-allow-greater-hostver-values.patch", + "patches/09-cve-2014-8139-crc-overflow.patch", + "patches/10-cve-2014-8140-test-compr-eb.patch", + "patches/11-cve-2014-8141-getzip64data.patch", + "patches/12-cve-2014-9636-test-compr-eb.patch", + "patches/13-remove-build-date.patch", + "patches/14-cve-2015-7696.patch", + "patches/15-cve-2015-7697.patch", + "patches/16-fix-integer-underflow-csiz-decrypted.patch", + "patches/17-restore-unix-timestamps-accurately.patch", + "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", + "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", + "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", + "patches/20-unzip60-alt-iconv-utf8.patch", + "patches/21-fix-warning-messages-on-big-files.patch", + "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", + "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", + "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", + "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", + "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", + "patches/27-zipgrep-avoid-test-errors.patch", + "patches/28-cve-2022-0529-and-cve-2022-0530.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "Buffer overflow in the zi_short function in zipinfo.c in Info-Zip UnZip 6.0 allows remote attackers to cause a denial of service (crash) via a large compression method value in the central directory file header.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "http://www.securityfocus.com/bid/94728" + }, + { + "type": "ADVISORY", + "url": "http://www.openwall.com/lists/oss-security/2016/12/05/13" + }, + { + "type": "ADVISORY", + "url": "http://www.openwall.com/lists/oss-security/2016/12/05/19" + }, + { + "type": "ADVISORY", + "url": "http://www.openwall.com/lists/oss-security/2016/12/05/20" + }, + { + "type": "REPORT", + "url": "https://bugs.launchpad.net/ubuntu/+source/unzip/+bug/1643750" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-unzip-CVE-2018-1000035", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2018-1000035" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "unzip", + "purl": "pkg:brew/unzip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0_4" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", + "apply": [ + "patches/01-manpages-in-section-1-not-in-section-1l.patch", + "patches/02-this-is-debian-unzip.patch", + "patches/03-include-unistd-for-kfreebsd.patch", + "patches/04-handle-pkware-verification-bit.patch", + "patches/05-fix-uid-gid-handling.patch", + "patches/06-initialize-the-symlink-flag.patch", + "patches/07-increase-size-of-cfactorstr.patch", + "patches/08-allow-greater-hostver-values.patch", + "patches/09-cve-2014-8139-crc-overflow.patch", + "patches/10-cve-2014-8140-test-compr-eb.patch", + "patches/11-cve-2014-8141-getzip64data.patch", + "patches/12-cve-2014-9636-test-compr-eb.patch", + "patches/13-remove-build-date.patch", + "patches/14-cve-2015-7696.patch", + "patches/15-cve-2015-7697.patch", + "patches/16-fix-integer-underflow-csiz-decrypted.patch", + "patches/17-restore-unix-timestamps-accurately.patch", + "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", + "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", + "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", + "patches/20-unzip60-alt-iconv-utf8.patch", + "patches/21-fix-warning-messages-on-big-files.patch", + "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", + "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", + "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", + "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", + "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", + "patches/27-zipgrep-avoid-test-errors.patch", + "patches/28-cve-2022-0529-and-cve-2022-0530.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2020/01/msg00026.html" + }, + { + "type": "ADVISORY", + "url": "https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-infozip-unzip/index.html" + }, + { + "type": "ADVISORY", + "url": "https://security.gentoo.org/glsa/202003-58" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-unzip-CVE-2019-13232", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-27T14:59:08Z", + "upstream": [ + "CVE-2019-13232" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "unzip", + "purl": "pkg:brew/unzip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0_6" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", + "apply": [ + "patches/01-manpages-in-section-1-not-in-section-1l.patch", + "patches/02-this-is-debian-unzip.patch", + "patches/03-include-unistd-for-kfreebsd.patch", + "patches/04-handle-pkware-verification-bit.patch", + "patches/05-fix-uid-gid-handling.patch", + "patches/06-initialize-the-symlink-flag.patch", + "patches/07-increase-size-of-cfactorstr.patch", + "patches/08-allow-greater-hostver-values.patch", + "patches/09-cve-2014-8139-crc-overflow.patch", + "patches/10-cve-2014-8140-test-compr-eb.patch", + "patches/11-cve-2014-8141-getzip64data.patch", + "patches/12-cve-2014-9636-test-compr-eb.patch", + "patches/13-remove-build-date.patch", + "patches/14-cve-2015-7696.patch", + "patches/15-cve-2015-7697.patch", + "patches/16-fix-integer-underflow-csiz-decrypted.patch", + "patches/17-restore-unix-timestamps-accurately.patch", + "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", + "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", + "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", + "patches/20-unzip60-alt-iconv-utf8.patch", + "patches/21-fix-warning-messages-on-big-files.patch", + "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", + "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", + "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", + "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", + "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", + "patches/27-zipgrep-avoid-test-errors.patch", + "patches/28-cve-2022-0529-and-cve-2022-0530.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a \"better zip bomb\" issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://support.f5.com/csp/article/K80311892?utm_source=f5support&%3Butm_medium=RSS" + }, + { + "type": "ADVISORY", + "url": "https://www.bamsoftware.com/hacks/zipbomb/" + }, + { + "type": "ADVISORY", + "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00005.html" + }, + { + "type": "ADVISORY", + "url": "https://lists.debian.org/debian-lts-announce/2019/07/msg00027.html" + }, + { + "type": "ADVISORY", + "url": "https://security.gentoo.org/glsa/202003-58" + }, + { + "type": "ADVISORY", + "url": "https://security.netapp.com/advisory/ntap-20190814-0002/" + }, + { + "type": "PACKAGE", + "url": "https://github.com/madler/unzip" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-unzip-CVE-2022-0529", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-18T04:02:33Z", + "upstream": [ + "CVE-2022-0529" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "unzip", + "purl": "pkg:brew/unzip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0_8" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", + "apply": [ + "patches/01-manpages-in-section-1-not-in-section-1l.patch", + "patches/02-this-is-debian-unzip.patch", + "patches/03-include-unistd-for-kfreebsd.patch", + "patches/04-handle-pkware-verification-bit.patch", + "patches/05-fix-uid-gid-handling.patch", + "patches/06-initialize-the-symlink-flag.patch", + "patches/07-increase-size-of-cfactorstr.patch", + "patches/08-allow-greater-hostver-values.patch", + "patches/09-cve-2014-8139-crc-overflow.patch", + "patches/10-cve-2014-8140-test-compr-eb.patch", + "patches/11-cve-2014-8141-getzip64data.patch", + "patches/12-cve-2014-9636-test-compr-eb.patch", + "patches/13-remove-build-date.patch", + "patches/14-cve-2015-7696.patch", + "patches/15-cve-2015-7697.patch", + "patches/16-fix-integer-underflow-csiz-decrypted.patch", + "patches/17-restore-unix-timestamps-accurately.patch", + "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", + "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", + "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", + "patches/20-unzip60-alt-iconv-utf8.patch", + "patches/21-fix-warning-messages-on-big-files.patch", + "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", + "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", + "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", + "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", + "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", + "patches/27-zipgrep-avoid-test-errors.patch", + "patches/28-cve-2022-0529-and-cve-2022-0530.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00028.html" + }, + { + "type": "ADVISORY", + "url": "https://security.gentoo.org/glsa/202310-17" + }, + { + "type": "ADVISORY", + "url": "https://www.debian.org/security/2022/dsa-5202" + }, + { + "type": "REPORT", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2051395" + }, + { + "type": "EVIDENCE", + "url": "https://github.com/ByteHackr/unzip_poc" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-unzip-CVE-2022-0530", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-18T04:02:33Z", + "upstream": [ + "CVE-2022-0530" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "unzip", + "purl": "pkg:brew/unzip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.0_8" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://archive.ubuntu.com/ubuntu/pool/main/u/unzip/unzip_6.0-28ubuntu4.1.debian.tar.xz", + "apply": [ + "patches/01-manpages-in-section-1-not-in-section-1l.patch", + "patches/02-this-is-debian-unzip.patch", + "patches/03-include-unistd-for-kfreebsd.patch", + "patches/04-handle-pkware-verification-bit.patch", + "patches/05-fix-uid-gid-handling.patch", + "patches/06-initialize-the-symlink-flag.patch", + "patches/07-increase-size-of-cfactorstr.patch", + "patches/08-allow-greater-hostver-values.patch", + "patches/09-cve-2014-8139-crc-overflow.patch", + "patches/10-cve-2014-8140-test-compr-eb.patch", + "patches/11-cve-2014-8141-getzip64data.patch", + "patches/12-cve-2014-9636-test-compr-eb.patch", + "patches/13-remove-build-date.patch", + "patches/14-cve-2015-7696.patch", + "patches/15-cve-2015-7697.patch", + "patches/16-fix-integer-underflow-csiz-decrypted.patch", + "patches/17-restore-unix-timestamps-accurately.patch", + "patches/18-cve-2014-9913-unzip-buffer-overflow.patch", + "patches/19-cve-2016-9844-zipinfo-buffer-overflow.patch", + "patches/20-cve-2018-1000035-unzip-buffer-overflow.patch", + "patches/20-unzip60-alt-iconv-utf8.patch", + "patches/21-fix-warning-messages-on-big-files.patch", + "patches/22-cve-2019-13232-fix-bug-in-undefer-input.patch", + "patches/23-cve-2019-13232-zip-bomb-with-overlapped-entries.patch", + "patches/24-cve-2019-13232-do-not-raise-alert-for-misplaced-central-directory.patch", + "patches/25-cve-2019-13232-fix-bug-in-uzbunzip2.patch", + "patches/26-cve-2019-13232-fix-bug-in-uzinflate.patch", + "patches/27-zipgrep-avoid-test-errors.patch", + "patches/28-cve-2022-0529-and-cve-2022-0530.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://support.apple.com/kb/HT213257" + }, + { + "type": "ADVISORY", + "url": "http://seclists.org/fulldisclosure/2022/May/33" + }, + { + "type": "ADVISORY", + "url": "https://support.apple.com/kb/HT213255" + }, + { + "type": "ADVISORY", + "url": "https://www.debian.org/security/2022/dsa-5202" + }, + { + "type": "ADVISORY", + "url": "http://seclists.org/fulldisclosure/2022/May/35" + }, + { + "type": "ADVISORY", + "url": "http://seclists.org/fulldisclosure/2022/May/38" + }, + { + "type": "ADVISORY", + "url": "https://lists.debian.org/debian-lts-announce/2022/09/msg00028.html" + }, + { + "type": "ADVISORY", + "url": "https://security.gentoo.org/glsa/202310-17" + }, + { + "type": "ADVISORY", + "url": "https://support.apple.com/kb/HT213256" + }, + { + "type": "REPORT", + "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2051395" + }, + { + "type": "EVIDENCE", + "url": "https://github.com/ByteHackr/unzip_poc" + } + ] + } + ], + "yajl": [ + { + "schema_version": "1.7.3", + "id": "BREW-yajl-CVE-2017-16516", + "published": "2026-07-18T04:02:33Z", + "modified": "2026-07-18T04:02:33Z", + "upstream": [ + "CVE-2017-16516", + "GHSA-wwh7-4jw9-33x6" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "yajl", + "purl": "pkg:brew/yajl" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.0_1" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://deb.debian.org/debian/pool/main/y/yajl/yajl_2.1.0-6.debian.tar.xz", + "apply": [ + "patches/dynamically-link-tools.patch", + "patches/CVE-2017-16516.patch", + "patches/CVE-2022-24795.patch", + "patches/CVE-2023-33460.patch", + "patches/6fe59ca50dfd65bdb3d1c87a27245b2dd1a072f9.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "In the yajl-ruby gem 1.3.0 for Ruby, when a crafted JSON file is supplied to Yajl::Parser.new.parse, the whole ruby process crashes with a SIGABRT in the yajl_string_decode function in yajl_encode.c. This results in the whole ruby process terminating and potentially a denial of service.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00013.html" + }, + { + "type": "WEB", + "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00003.html" + }, + { + "type": "ADVISORY", + "url": "https://lists.debian.org/debian-lts-announce/2017/11/msg00010.html" + }, + { + "type": "ADVISORY", + "url": "https://rubygems.org/gems/yajl-ruby" + }, + { + "type": "EVIDENCE", + "url": "https://github.com/brianmario/yajl-ruby/issues/176" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-yajl-CVE-2022-24795", + "published": "2026-07-18T04:02:33Z", + "modified": "2026-07-18T04:02:33Z", + "upstream": [ + "CVE-2022-24795", + "GHSA-jj47-x69x-mxrm" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "yajl", + "purl": "pkg:brew/yajl" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.0_1" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://deb.debian.org/debian/pool/main/y/yajl/yajl_2.1.0-6.debian.tar.xz", + "apply": [ + "patches/dynamically-link-tools.patch", + "patches/CVE-2017-16516.patch", + "patches/CVE-2022-24795.patch", + "patches/CVE-2023-33460.patch", + "patches/6fe59ca50dfd65bdb3d1c87a27245b2dd1a072f9.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "summary": "Buffer Overflow and Integer Overflow in yajl-ruby", + "details": "yajl-ruby is a C binding to the YAJL JSON parsing and generation library. The 1.x branch and the 2.x branch of `yajl` contain an integer overflow which leads to subsequent heap memory corruption when dealing with large (~2GB) inputs. The reallocation logic at `yajl_buf.c#L64` may result in the `need` 32bit integer wrapping to 0 when `need` approaches a value of 0x80000000 (i.e. ~2GB of data), which results in a reallocation of buf->alloc into a small heap chunk. These integers are declared as `size_t` in the 2.x branch of `yajl`, which practically prevents the issue from triggering on 64bit platforms, however this does not preclude this issue triggering on 32bit builds on which `size_t` is a 32bit integer. Subsequent population of this under-allocated heap chunk is based on the original buffer size, leading to heap memory corruption. This vulnerability mostly impacts process availability. Maintainers believe exploitation for arbitrary code execution is unlikely. A patch is available and anticipated to be part of yajl-ruby version 1.4.2. As a workaround, avoid passing large inputs to YAJL.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/brianmario/yajl-ruby/blob/7168bd79b888900aa94523301126f968a93eb3a6/ext/yajl/yajl_buf.c#L64" + }, + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24795.json" + }, + { + "type": "ADVISORY", + "url": "https://github.com/brianmario/yajl-ruby/security/advisories/GHSA-jj47-x69x-mxrm" + }, + { + "type": "ADVISORY", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLE3C4CECEJ4EUYI56KXI6OWACWXX7WN/" + }, + { + "type": "ADVISORY", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO32YDJ74DADC7CMJNLSLBVWN5EXGF5J/" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24795" + }, + { + "type": "FIX", + "url": "https://github.com/brianmario/yajl-ruby/commit/7168bd79b888900aa94523301126f968a93eb3a6" + }, + { + "type": "ARTICLE", + "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00013.html" + }, + { + "type": "ARTICLE", + "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00003.html" + } + ] + }, + { + "schema_version": "1.7.3", + "id": "BREW-yajl-CVE-2023-33460", + "published": "2026-07-18T04:02:33Z", + "modified": "2026-07-18T04:02:33Z", + "upstream": [ + "CVE-2023-33460" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "yajl", + "purl": "pkg:brew/yajl" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.1.0_1" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://deb.debian.org/debian/pool/main/y/yajl/yajl_2.1.0-6.debian.tar.xz", + "apply": [ + "patches/dynamically-link-tools.patch", + "patches/CVE-2017-16516.patch", + "patches/CVE-2022-24795.patch", + "patches/CVE-2023-33460.patch", + "patches/6fe59ca50dfd65bdb3d1c87a27245b2dd1a072f9.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and cause crash.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33460.json" + }, + { + "type": "ADVISORY", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBUUHG27RM4ROEYKMVRROR27AX6R63MB/" + }, + { + "type": "ADVISORY", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KLE3C4CECEJ4EUYI56KXI6OWACWXX7WN/" + }, + { + "type": "ADVISORY", + "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YO32YDJ74DADC7CMJNLSLBVWN5EXGF5J/" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33460" + }, + { + "type": "REPORT", + "url": "https://github.com/lloyd/yajl/issues/250" + }, + { + "type": "ARTICLE", + "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00000.html" + }, + { + "type": "ARTICLE", + "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00013.html" + }, + { + "type": "ARTICLE", + "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00003.html" + } + ] + } + ], + "zip": [ + { + "schema_version": "1.7.3", + "id": "BREW-zip-CVE-2018-13410", + "published": "2026-06-28T21:29:54Z", + "modified": "2026-07-18T04:02:33Z", + "upstream": [ + "CVE-2018-13410" + ], + "affected": [ + { + "package": { + "ecosystem": "Homebrew", + "name": "zip", + "purl": "pkg:brew/zip" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.0_1" + } + ] + } + ], + "ecosystem_specific": { + "fix": "patch", + "patches": [ + { + "type": "unofficial", + "url": "https://deb.debian.org/debian/pool/main/z/zip/zip_3.0-15.debian.tar.xz", + "apply": [ + "patches/01-typo-it-is-transferring-not-transfering.patch", + "patches/02-typo-it-is-privileges-not-priviliges.patch", + "patches/03-manpages-in-section-1-not-in-section-1l.patch", + "patches/04-do-not-set-unwanted-cflags.patch", + "patches/05-typo-it-is-preceding-not-preceeding.patch", + "patches/06-stack-markings-to-avoid-executable-stack.patch", + "patches/07-fclose-in-file-not-fclose-x.patch", + "patches/08-hardening-build-fix-1.patch", + "patches/09-hardening-build-fix-2.patch", + "patches/10-remove-build-date.patch", + "patches/11-typo-it-is-ambiguities-not-amgibuities.patch", + "patches/13-typo-it-is-os-2-not-risc-os-2.patch", + "patches/14-buffer-overflow-unicode-filename.patch", + "patches/15-buffer-overflow-cve-2018-13410.patch", + "patches/16-fix-symlink-update-detection.patch" + ] + } + ] + } + } + ], + "database_specific": { + "source": "generated" + }, + "details": "Info-ZIP Zip 3.0, when the -T and -TT command-line options are used, allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value, given that the entire purpose of -TT is execution of arbitrary commands", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "http://seclists.org/fulldisclosure/2018/Jul/24" + } + ] + } + ] + } +} diff --git a/lib/advisory_index.rb b/lib/advisory_index.rb new file mode 100644 index 000000000..ff510656b --- /dev/null +++ b/lib/advisory_index.rb @@ -0,0 +1,60 @@ +# frozen_string_literal: true + +require "fileutils" +require "json" + +# Concatenates every record under `advisories/` into a single +# `data/advisories.json` indexed by formula name, so consumers +# (`brew generate-formula-api`, `brew vulns`, formulae.brew.sh) can fetch the +# whole corpus in one request instead of one per record. +# +# Output shape: +# +# { +# "meta": {"count": N, "schema_version": "..."}, +# "advisories": {"": [{}, ...], ...} +# } +# +# Records are grouped by `affected[0].package.name` and sorted by `id` within +# each group so the file is deterministic and diffs stay readable. +module AdvisoryIndex + module_function + + def build(dir) + by_formula = Hash.new { |h, k| h[k] = [] } + schema_versions = [] + + Dir.glob(File.join(dir, "*.json")).sort.each do |path| + record = JSON.parse(File.read(path)) + name = record.dig("affected", 0, "package", "name") + raise "#{path}: missing affected[0].package.name" unless name + + by_formula[name] << record + schema_versions << record["schema_version"] + end + + # Every record is regenerated together by `brew generate-vulns-advisories`, + # so a mix of schema versions indicates a generator bug. Fail loudly rather + # than report a single version that only holds for some records. + versions = schema_versions.compact.uniq + raise "mixed schema_version across advisories: #{versions.sort.inspect}" if versions.size > 1 + + { + "meta" => { + "count" => by_formula.each_value.sum(&:size), + "schema_version" => versions.first, + }, + "advisories" => by_formula.transform_values { |records| records.sort_by { |r| r.fetch("id") } } + .sort.to_h, + } + end + + def write(source_dir, out_path) + result = build(source_dir) + FileUtils.mkdir_p(File.dirname(out_path)) + File.write(out_path, "#{JSON.pretty_generate(result)}\n") + warn "[advisories] wrote #{result["meta"]["count"]} records across " \ + "#{result["advisories"].size} formulae to #{out_path} (#{File.size(out_path)} bytes)" + result + end +end diff --git a/test/advisory_index_test.rb b/test/advisory_index_test.rb new file mode 100644 index 000000000..f77185622 --- /dev/null +++ b/test/advisory_index_test.rb @@ -0,0 +1,83 @@ +# frozen_string_literal: true + +require_relative "test_helper" +require "advisory_index" + +class AdvisoryIndexTest < Minitest::Test + def with_records(records) + Dir.mktmpdir do |dir| + records.each do |id, body| + File.write(File.join(dir, "#{id}.json"), JSON.generate(body)) + end + yield dir + end + end + + def record(id, formula, schema: "1.7.3") + { "schema_version" => schema, "id" => id, + "affected" => [{ "package" => { "ecosystem" => "Homebrew", "name" => formula } }] } + end + + def test_build_groups_by_formula_sorted_by_id + with_records( + "BREW-foo-CVE-2" => record("BREW-foo-CVE-2", "foo"), + "BREW-foo-CVE-1" => record("BREW-foo-CVE-1", "foo"), + "BREW-bar-CVE-1" => record("BREW-bar-CVE-1", "bar"), + ) do |dir| + result = AdvisoryIndex.build(dir) + assert_equal 3, result["meta"]["count"] + assert_equal "1.7.3", result["meta"]["schema_version"] + assert_equal %w[bar foo], result["advisories"].keys + assert_equal ["BREW-foo-CVE-1", "BREW-foo-CVE-2"], + result["advisories"]["foo"].map { |r| r["id"] } + end + end + + def test_build_raises_on_mixed_schema_versions + with_records( + "a" => record("a", "x", schema: "1.7.3"), + "b" => record("b", "x", schema: "1.8.0"), + ) do |dir| + err = assert_raises(RuntimeError) { AdvisoryIndex.build(dir) } + assert_match(/mixed schema_version.*1\.7\.3.*1\.8\.0/, err.message) + end + end + + def test_build_raises_on_missing_package_name + with_records("bad" => { "id" => "bad", "affected" => [{}] }) do |dir| + err = assert_raises(RuntimeError) { AdvisoryIndex.build(dir) } + assert_match(/bad\.json.*missing affected/, err.message) + end + end + + def test_build_empty_directory + Dir.mktmpdir do |dir| + result = AdvisoryIndex.build(dir) + assert_equal 0, result["meta"]["count"] + assert_empty result["advisories"] + end + end + + def test_write_emits_pretty_json_with_trailing_newline + with_records("BREW-foo-CVE-1" => record("BREW-foo-CVE-1", "foo")) do |dir| + Dir.mktmpdir do |out_dir| + out = File.join(out_dir, "sub", "advisories.json") + _, err = capture_io { AdvisoryIndex.write(dir, out) } + assert_match(/wrote 1 records across 1 formulae/, err) + body = File.read(out) + assert body.end_with?("\n") + assert_equal ["foo"], JSON.parse(body)["advisories"].keys + end + end + end + + def test_build_real_advisories_directory + result = AdvisoryIndex.build(File.expand_path("../advisories", __dir__)) + assert result["meta"]["count"].positive? + result["advisories"].each_value do |records| + records.each do |r| + assert_equal "Homebrew", r.dig("affected", 0, "package", "ecosystem") + end + end + end +end