gdb-frontend

GDBFrontend is an easy, flexible and extensionable gui debugger. Installing Requirements GDB = 8.2 with python3 python3 = 3.6 tmux PIP Package Python Wheel Recommended You can install GDBFrontend with pip. sudo python3 -m pip install gdbfrontend if it is already installed and you are upgrading su...

trivy-repo

trivy-repo deb/rpm repository for Trivy Debian/Ubuntu $ sudo apt-get install wget apt-transport-https gnupg $ wget -qO - https://get.trivy.dev/deb/public.key | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg /dev/null $ echo "deb signed-by=/usr/share/keyrings/trivy.gpg...

Debinject

Debinject Inject malicious code into .debs MAINTAINERS Alisson Moretto | Twitter: @UndeadSec Github: @UndeadSec VIDEO DEMO CLONE git clone https://github.com/UndeadSec/Debinject.git RUNNING cd Debinject python debinject.py PREREQUISITES python 2.x dpkg dpkg-deb metasploit DISCLAIMER TO BE USED FO...

reposaur

Reposaur Reposaur is the open source compliance tool for development platforms. Audit, verify and report on your data and configurations easily with pre-defined and/or custom policies. Supports GitHub. GitLab, BitBucket and Gitea support soon. ⚠️ before 1.0.0 expect some bugs and API changes ⚠️...

CVE-2026-90954

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

UBUNTU-CVE-2026-90954

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

Linux Distros Unpatched Vulnerability : CVE-2026-90954

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and...

DEBIAN-CVE-2026-90954

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

CVE-2026-90954

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

CVE-2026-90954

A flaw exists in BusyBox 's dpkg-deb archive extraction where the ar archive handler flushes deferred symlinks after each member, unlike other handlers. An attacker can craft a .deb archive with two data.tar members: the first creates a symlink to an absolute path (e.g., /), which is flushed imme...

EUVD-2026-100951

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

CVE-2026-90954 Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

CVE-2026-90954

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

CVE-2026-90954

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

CVE-2026-90954: Improper Link Resolution Before File Access

A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this...

PT-2026-113747

Name of the Vulnerable Software and Affected Versions BusyBox affected versions not specified Description A flaw exists in the dpkg-deb archive extraction process. The ar archive handler flushes deferred symlinks after each archive member, whereas other handlers like tar, cpio, and unzip only flu...

CVE-2026-102490 Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package

Zammad packages built with packager.io DEB and RPM could have allowed a local attacker who already had file system write privileges as the unprivileged zammad service account to escalate to full root privileges on the host. Service processes began running as root and executed files that were owne...

busybox: busybox: dpkg read_package_field() steps past NUL terminator, causing out-of-bounds read on malformed .deb packages

BusyBox dpkg readpackagefield steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read...

pulp-ansible (>=0.28.0, <=0.28.9), pulp-container (>=2.26.0, <=2.26.19) +9 more potentially affected by CVE-2026-90959 via pulpcore (3.95.3)

pulpcore PYPI version 3.95.3 is affected by a known vulnerability. The following packages have a transitive dependency on pulpcore and may be impacted: - pulp-ansible =0.28.0, =2.26.0, =3.7.0, =0.7.2, =2.5.0, =3.18.0, =3.32.0, =3.33.1 - pulp-smart-proxy 0.3.0 Source cves: CVE-2026-90959 Source...

pulp-ansible (>=0.22.0, <=0.23.1), pulp-container (>=2.21.0, <=2.22.13) +6 more potentially affected by CVE-2026-90959 via pulpcore (3.69.2)

pulpcore PYPI version 3.69.2 is affected by a known vulnerability. The following packages have a transitive dependency on pulpcore and may be impacted: - pulp-ansible =0.22.0, =2.21.0, =3.3.0, =0.6.0, =0.8.1, =2.4.0, =3.12.0, =3.25.6, =3.27.14 Source cves: CVE-2026-90959 Source advisory:...