11209 matches found
ECHO-DB1D-DF7F-29B4
Bulletin has no description...
ECHO-60B6-E448-56A4
Bulletin has no description...
ECHO-E0BB-5E4C-E923
Bulletin has no description...
ECHO-15CA-DAB4-9613
Bulletin has no description...
ECHO-0B68-19F2-1A40
Bulletin has no description...
ECHO-AA38-89D5-F024
Bulletin has no description...
ECHO-F83A-F1A3-51C1 The CVE has been rejected by the assigning CNA (Red Hat, CVSS 0.0): per upstream security policy binutils treats its input as trusted, so no security boundary is crossed. No fix exists upstream or in any Debian suite.
Bulletin has no description...
ECHO-79D4-B3D1-2520
Bulletin has no description...
ECHO-1FCB-1955-3C69
Bulletin has no description...
ECHO-F93B-D78B-821C
Bulletin has no description...
ECHO-A321-5A7E-9F85
Bulletin has no description...
ECHO-E9AC-F08E-3A77
Bulletin has no description...
ECHO-AC3C-11A6-BE31
Bulletin has no description...
ECHO-12E4-CC24-CB8A
Bulletin has no description...
ECHO-A707-D13A-55BA
Bulletin has no description...
ECHO-A826-5210-69D0
Bulletin has no description...
ECHO-C67D-4DCA-CE2D
Bulletin has no description...
ECHO-C5B2-F0EF-2FCD
Bulletin has no description...
ECHO-C00A-FF37-8BCD
Bulletin has no description...
ECHO-3C27-FC81-AC46 Heap overflow in fs_read_glyphs() in the font-server client (src/fc/fserve.c). Debian builds libXfont2 with --disable-fc (debian/rules), so the font-server client is not compiled: the shipped libXfont2.so.2.0.0 (1:2.0.6-1+deb13u1) contains no fs_read_glyphs or other fserve code. Debian rates it unimportant ("Disabled support to connect to font server since 1:1.4.7-1").
Bulletin has no description...
ECHO-330D-604F-B5E0
Bulletin has no description...
ECHO-638B-FA07-509A
Bulletin has no description...
ECHO-E3E4-CB4D-33F5
Bulletin has no description...
ECHO-80CE-B9D4-0CB2
Bulletin has no description...
ECHO-855F-2128-6E3E
Bulletin has no description...
ECHO-B709-48C4-0C80 The CVE reports that cJSONUtils_ApplyPatches() mutates the target when a patch fails part-way, "defeating the all-or-nothing behavior callers rely on". cJSON never offers that guarantee: cJSON_Utils.h documents "Note that ApplyPatches is NOT atomic on failure" and gives the Duplicate-then-swap recipe for callers that need atomicity. No memory-safety impact; the behaviour is the documented API contract. Upstream has not commented and Debian lists it unfixed with no fix in any suite.
Bulletin has no description...
ECHO-D2AD-9332-96C9
Bulletin has no description...
ECHO-9710-769A-B90B
Bulletin has no description...
ECHO-8C91-0553-6384
Bulletin has no description...
ECHO-11D6-76D1-7D99
Bulletin has no description...
ECHO-3B36-2D36-ACBD
Bulletin has no description...
ECHO-1D65-8FC1-D730 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-F882-8A7B-12E4 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-C31C-F334-FF6B Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-89A3-7847-54C4 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-56D3-60AC-82F6 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-6DC1-CEF9-EE9D Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-90F6-B270-6CAB Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-D581-474B-33E7 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-D088-1F41-49DB
Bulletin has no description...
ECHO-191B-44FE-7772 Heap out-of-bounds write in the native PNG/APNG encoder when writing a crafted eXIf chunk (add_exif_profile_size() underestimates the sanitized IFD size). The eXIf-writing code does not exist in this source: libavcodec/pngenc.c at n7.1.5 (and on the release/7.1 branch) has no EXIF/IFD handling at all; it was added in the 8.x series, which is why the CVE range reads "through 8.1.2". Upstream fix b506fafe cannot apply here because the code it patches is absent. Refs: - https://security-tracker.debian.org/tracker/CVE-2026-66040 - https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b506fafec9a19fcbc2be5271875fd4a63d6615bc details: | If this spec is ever bumped to a version whose pngenc.c writes eXIf chunks (8.1+), this entry MUST be re-evaluated and converted into a real PATCH_TYPE_UPSTREAM_PATCH entry.
Bulletin has no description...
ECHO-3341-E81D-BF5B
Bulletin has no description...
ECHO-18B0-99B8-3F51 Vulnerability is in a Vulkan HEVC decoder code path that does not exist in this version. Refs: - https://security-tracker.debian.org/tracker/CVE-2026-64831 details: | The vulnerable code (a stack-allocated VPS/SPS parameter struct built per-frame in vk_hevc_end_frame(), overflowed by an unchecked vps_num_hrd_parameters) was introduced by upstream commit 82864c21 ("vulkan_hevc: use VK_KHR_video_maintenance2 if available", 2026-03-14) as part of a refactor that is not present in the 7.1.x branch. In this source, vk_hevc_end_frame() has no such stack buffer: VPS HRD parameters are built once into a heap buffer in alloc_hevc_header_structs()/set_vps(), whose destination arrays are bounded by HEVC_MAX_LAYER_SETS (1024), and vps_num_hrd_parameters is already bounded by vps_num_layer_sets (<=1024) at parse time in libavcodec/hevc/ps.c. The CVE's own affected-version range ("FFmpeg 8.0 through 8.1.2") is consistent with this. If this spec is ever bumped to >=8.0, this entry MUST be re-evaluated and likely converted into a real patch.
Bulletin has no description...
ECHO-2666-6303-C7A7
Bulletin has no description...
ECHO-E01E-70FF-C35F
Bulletin has no description...
ECHO-29F5-C1F8-003E
Bulletin has no description...
ECHO-F90F-4A99-3511
Bulletin has no description...
ECHO-FAC5-2977-3A4E
Bulletin has no description...