5107 matches found
ECHO-D96B-E170-7D9F
Bulletin has no description...
ECHO-39C4-8954-FB97
Bulletin has no description...
ECHO-3C38-BC73-3E4D
Bulletin has no description...
ECHO-496E-C070-4EC0
Bulletin has no description...
ECHO-B241-5686-39E3
Bulletin has no description...
ECHO-9465-9EE0-5DDB
Bulletin has no description...
ECHO-99BB-E39E-27A9
Bulletin has no description...
ECHO-2B7C-3E7E-DDA7
Bulletin has no description...
ECHO-2905-42D3-1810
Bulletin has no description...
ECHO-6841-5622-FD54
Bulletin has no description...
ECHO-1AB4-0CE9-DAB7
Bulletin has no description...
ECHO-C8D6-0C6B-390B
Bulletin has no description...
ECHO-47F1-73FB-7E9F Multiple unbounded alloca() calls in the PulseAudio protocol server, which an attacker can drive into a stack overflow by sending oversized protocol messages. The vulnerable code is the server side of the protocol. It builds into the PulseAudio daemon, shipped in the `pulseaudio` binary package, described by Debian as the "PulseAudio sound server". Echo containers do not install that package. What they pull in, as a transitive dependency of Chromium's audio support, is `libpulse0` — the "PulseAudio client libraries" — which ships only libpulse, libpulse-simple and libpulsecommon. There is no protocol server in those objects and no daemon on the image to reach. `libpulse0` is flagged only because it is built from the same `pulseaudio` source package that the advisory names, so a source-level match tags every binary package built from it, including ones that carry none of the affected code. Upstream attributes the flaw to PipeWire rather than PulseAudio. Red Hat files it as "pipewire: Pulse Server alloca Stack Overflow", NVD lists pipewire and libkrun as the affected packages, and Ubuntu's fix patches only PipeWire sources — module-protocol-pulse/pulse-server.c, message.c and defs.h. Debian tracks CVE-2026-14324, the sibling issue from that same advisory, against the pipewire source package, but filed this one under pulseaudio. No Echo image installs pipewire in any form. Verified on the built image: libpulse0 is the only pulse-related package present, with no daemon binary, no pipewire and no wireplumber. Its three objects — libpulse, libpulse-simple and libpulsecommon — export no protocol-server symbols and reference none of the affected sources; the source files they were built from are client and common code only, with no protocol-native.c. Debian rates the issue minor and marks it <no-dsa> for trixie. It is unfixed in every suite — trixie has 17.0+dfsg1-2 and forky/sid have 17.0+dfsg1-2.1, both vulnerable — so there is no version to move to even if it did apply. This statement is about which binary package carries the code, so it holds for as long as the image installs the client libraries without the daemon. MUST be re-evaluated if the `pulseaudio` package is ever added. https://security-tracker.debian.org/tracker/CVE-2026-14330
Bulletin has no description...
ECHO-F301-3BAE-8FC2
Bulletin has no description...
ECHO-319A-CD5A-1244
Bulletin has no description...
ECHO-FC41-FB45-B35D
Bulletin has no description...
ECHO-7216-16A7-BB97
Bulletin has no description...
ECHO-2CCA-777E-5D89
Bulletin has no description...