ROOT-OS-DEBIAN-11-CVE-2025-49506 CVE-2025-49506 in apr-util - Patched by Root

Root has patched CVE-2025-49506 in the apr-util package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-34191 CVE-2026-34191 in apr-util - Patched by Root

Root has patched CVE-2026-34191 in the apr-util package for Root:Debian:11. Multiple fixed versions available...

ROOT-OS-DEBIAN-11-CVE-2026-34501 CVE-2026-34501 in apr-util - Patched by Root

Root has patched CVE-2026-34501 in the apr-util package for Root:Debian:11. Multiple fixed versions available...

CVE-2026-53614

A flaw was found in util-linux. The mount8 SUID binary does not sanitize the LIBMOUNTFORCEMOUNT2 environment variable before use. A local unprivileged user can set this variable to force mount8 to use the legacy two-step mount2 code path, which applies security restrictions such as nosuid and...

CVE-2026-53613

A flaw was found in util-linux. When an /etc/fstab entry is configured with the user or users option, mount8 validates the target path before performing the mount syscall, creating a Time-of-Check-Time-of-Use TOCTOU window. A local unprivileged user with write access to an ancestor directory of t...

CVE-2026-53612

A flaw was found in util-linux. When an /etc/fstab entry uses the user option together with X-mount.owner, X-mount.group, or X-mount.mode, mount8 changes ownership or permissions on the mount target after mounting without re-verifying the path. A local unprivileged user can exploit this...

ROOT-OS-DEBIAN-12-CVE-2026-3184 CVE-2026-3184 in util-linux - Patched by Root

Root has patched CVE-2026-3184 in the util-linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2022-0563 CVE-2022-0563 in util-linux - Patched by Root

Root has patched CVE-2022-0563 in the util-linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-13595 CVE-2026-13595 in util-linux - Patched by Root

Root has patched CVE-2026-13595 in the util-linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-27456 CVE-2026-27456 in util-linux - Patched by Root

Root has patched CVE-2026-27456 in the util-linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-14104 CVE-2025-14104 in util-linux - Patched by Root

Root has patched CVE-2025-14104 in the util-linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-53615 CVE-2026-53615 in util-linux - Patched by Root

Root has patched CVE-2026-53615 in the util-linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-UBUNTU-2404-CVE-2026-27456 CVE-2026-27456 in util-linux - Patched by Root

Root has patched CVE-2026-27456 in the util-linux package for Root:Ubuntu:24.04. Multiple fixed versions available...

CVE-2026-34502 affecting package apr-util for versions less than 1.6.3-3

CVE-2026-34502 affecting package apr-util for versions less than 1.6.3-3. A patched version of the package is available...

CVE-2026-32327 affecting package apr-util for versions less than 1.6.3-3

CVE-2026-32327 affecting package apr-util for versions less than 1.6.3-3. A patched version of the package is available...

CVE-2025-49506 affecting package apr-util for versions less than 1.6.3-3

CVE-2025-49506 affecting package apr-util for versions less than 1.6.3-3. A patched version of the package is available...

CVE-2026-34501 affecting package apr-util for versions less than 1.6.3-3

CVE-2026-34501 affecting package apr-util for versions less than 1.6.3-3. A patched version of the package is available...

CVE-2026-74905 SiYuan before v3.7.4 SSRF via IPv6 Transition Address Bypass

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

BIT-APR-UTIL-2025-49506 Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack

APR-util versions 1.6.3 and earlier function aprpasswordvalidate was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt such as Windows, BeOS, NetWare, or Android. Users are...

[SECURITY] [DSA 6442-1] util-linux security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6442-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso August 14, 2026 https://www.debian.org/security/faq -...