11303 matches found
ECHO-4C92-12CE-A2F9
Bulletin has no description...
ECHO-FB63-BE72-1568
Bulletin has no description...
ECHO-A34C-1D60-970C
Bulletin has no description...
ECHO-7E7A-642B-3D93
Bulletin has no description...
ECHO-72F2-8496-5834
Bulletin has no description...
ECHO-9359-81F3-4B4B
Bulletin has no description...
ECHO-2296-1FB1-7EC2
Bulletin has no description...
ECHO-2F77-0A3F-C878
Bulletin has no description...
ECHO-FFB1-08BB-E5B4
Bulletin has no description...
ECHO-C8DB-DF83-8812
Bulletin has no description...
ECHO-48CD-35F6-43FD
Bulletin has no description...
ECHO-9D25-083F-FEDF
Bulletin has no description...
ECHO-CF23-B450-BCBC
Bulletin has no description...
ECHO-E672-55E9-2902
Bulletin has no description...
ECHO-2142-C2ED-FA0B
Bulletin has no description...
ECHO-75F9-4777-A649 Node.js-only: server.js ends the process on any per-connection error. Built with --without-nodejs; no Node binary package is produced.
Bulletin has no description...
ECHO-EEB1-DF32-DBAA The vulnerable code postdates this version. The Python >= 3.12 no-op host-name matcher (sslcompat returning True when ssl.match_hostname is missing) was introduced by 23e0e5ce (first released in 0.22.0) and is not an ancestor of v0.19.0. On trixie's Python 3.13 this version's sslcompat falls back to legacy_validate_callback, which compares the certificate commonName and raises on a mismatch; TSSLSocket uses PROTOCOL_SSLv23 (the PROTOCOL_TLS alias) with check_hostname off, so that callback is the check that runs. Verified with real handshakes against the built lib on Python 3.13.5: a certificate for "localhost" offered to a client expecting "wrong.example" is refused with the default ssl_version, with an explicit PROTOCOL_TLS (the upstream regression case) and with PROTOCOL_TLSv1_2, and TSSLServerSocket refuses a trusted client certificate issued for another identity. The same script against upstream v0.24.0's lib accepts both explicit-ssl_version mismatches, as the CVE describes. The fix d6782a87 restores a real matcher in sslcompat (code this version never lost) and turns on check_hostname for explicit-ssl_version contexts, which 0.19.0 does not need because open() always runs _validate_callback. Same reasoning as CVE-2026-66053.
Bulletin has no description...
ECHO-8A2E-E261-ED24 Ruby-only: TJsonProtocol has no string size bound. lib/rb is built but never packaged, for the reason given under CVE-2026-49158.
Bulletin has no description...
ECHO-7068-A82E-7936 Dart-only: TBinaryProtocol.readMessageBegin allocates from the pre-versioned name length. No Dart SDK is in Build-Depends, and no binary package ships lib/dart.
Bulletin has no description...
ECHO-D8CD-76F2-90CE
Bulletin has no description...
ECHO-0AB6-1F5D-9AD5
Bulletin has no description...
ECHO-DA7D-A825-B73B Vulnerability is in the NVIDIA kernel-mode driver (nvidia.ko / open kernel module). Echo ships only the userspace cuda-compat libraries (libcuda, nvvm, ptxjitcompiler, ...) via the cuda-* packages; that component is provided by the host, not the image. https://github.com/NVIDIA/product-security/tree/main/2026/5861
Bulletin has no description...
ECHO-3E27-9E15-144D Vulnerability is in the NVIDIA kernel-mode driver (nvidia.ko / open kernel module). Echo ships only the userspace cuda-compat libraries (libcuda, nvvm, ptxjitcompiler, ...) via the cuda-* packages; that component is provided by the host, not the image. https://github.com/NVIDIA/product-security/tree/main/2026/5861
Bulletin has no description...
ECHO-F517-88C0-15E2
Bulletin has no description...
ECHO-1365-275D-5569 Vulnerability is in GPU firmware (GSP / secure microcontroller), loaded by the host kernel driver. Echo ships only the userspace cuda-compat libraries (libcuda, nvvm, ptxjitcompiler, ...) via the cuda-* packages; that component is provided by the host, not the image. https://github.com/NVIDIA/product-security/tree/main/2026/5861
Bulletin has no description...
ECHO-B409-F723-46B2 Vulnerability is in the NVIDIA kernel-mode driver (nvidia.ko / open kernel module). Echo ships only the userspace cuda-compat libraries (libcuda, nvvm, ptxjitcompiler, ...) via the cuda-* packages; that component is provided by the host, not the image. https://github.com/NVIDIA/product-security/tree/main/2026/5861
Bulletin has no description...
ECHO-CA15-C824-BA55 Vulnerability is in the NVIDIA kernel-mode driver (nvidia.ko / open kernel module). Echo ships only the userspace cuda-compat libraries (libcuda, nvvm, ptxjitcompiler, ...) via the cuda-* packages; that component is provided by the host, not the image. https://github.com/NVIDIA/product-security/tree/main/2026/5861
Bulletin has no description...
ECHO-2C86-1C61-2E44 Vulnerability is in the NVIDIA kernel-mode driver (nvidia.ko / open kernel module). Echo ships only the userspace cuda-compat libraries (libcuda, nvvm, ptxjitcompiler, ...) via the cuda-* packages; that component is provided by the host, not the image. https://github.com/NVIDIA/product-security/tree/main/2026/5861
Bulletin has no description...
ECHO-E645-F4C4-769E
Bulletin has no description...
ECHO-6674-10AB-A873
Bulletin has no description...
ECHO-669E-7F60-F638
Bulletin has no description...
ECHO-20D5-2851-E01F
Bulletin has no description...
ECHO-4C1A-F6D4-292C
Bulletin has no description...
ECHO-DDA8-CBD3-A65A
Bulletin has no description...
ECHO-728A-4CA3-07F3
Bulletin has no description...
ECHO-7C8B-C5A6-558D
Bulletin has no description...
ECHO-39B2-3209-49FE
Bulletin has no description...
ECHO-65AA-DFA0-C380
Bulletin has no description...
ECHO-0F33-F9B7-76C3
Bulletin has no description...
ECHO-2AEE-4E8E-FE64
Bulletin has no description...
ECHO-B8CF-50B8-5B03
Bulletin has no description...
ECHO-8D08-566A-3802
Bulletin has no description...
ECHO-312D-3FE3-AE81
Bulletin has no description...
ECHO-7CDD-58B9-B940
Bulletin has no description...
ECHO-208B-D6B3-DFB9
Bulletin has no description...
ECHO-FFFA-11EE-E557
Bulletin has no description...
ECHO-0947-A5DB-6850
Bulletin has no description...
ECHO-71D6-5F21-0FD8
Bulletin has no description...