| CVE-2026-2219 | ALTO7.5 | It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU). | 07/03/2026 |
| CVE-2025-8454 | CRÍTICO9.8 | It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification | 01/08/2025 |
| CVE-2025-6297 | ALTO8.2 | It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is
documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg | 01/07/2025 |
| CVE-2015-0849 | BAIXO3.9 | pycode-browser before version 1.0 is prone to a predictable temporary file vulnerability. | 26/06/2025 |
| CVE-2015-0843 | CRÍTICO9.8 | yubiserver before 0.6 is prone to buffer overflows due to misuse of sprintf. | 26/06/2025 |
| CVE-2015-0842 | CRÍTICO9.8 | yubiserver before 0.6 is prone to SQL injection issues, potentially leading to an authentication bypass. | 26/06/2025 |
| CVE-2014-7210 | CRÍTICO9.8 | pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user. It was discovered that the maintainer scripts of pdns-backend-mysql grant too wide database permissions for the pdns user. Other backends
are not affected. | 26/06/2025 |
| CVE-2013-1424 | MÉDIO5.6 | Buffer overflow vulnerability in matplotlib.This issue affects matplotlib: before upstream commit ba4016014cb4fb4927e36ce8ea429fed47dcb787. | 26/06/2025 |
| CVE-2023-27635 | ALTO7.8 | debmany in debian-goodies 0.88.1 allows attackers to execute arbitrary shell commands (because of an eval call) via a crafted .deb file. (The path is shown to the user before execution.) | 05/03/2023 |
| CVE-2017-20148 | CRÍTICO9.8 | In the ebuild package through logcheck-1.3.23.ebuild for Logcheck on Gentoo, it is possible to achieve root privilege escalation from the logcheck user because of insecure recursive chown calls. | 20/09/2022 |
| CVE-2022-2787 | MÉDIO4.3 | Schroot before 1.6.13 had too permissive rules on chroot or session names, allowing a denial of service on the schroot service for all users that may start a schroot session. | 27/08/2022 |
| CVE-2022-1664 | CRÍTICO9.8 | Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory tra | 26/05/2022 |
| CVE-2016-1239 | CRÍTICO9.8 | duck before 0.10 did not properly handle loading of untrusted code from the current directory. | 19/02/2022 |
| CVE-2021-38172 | CRÍTICO9.8 | perM 0.4.0 has a Buffer Overflow related to strncpy. (Debian initially fixed this in 0.4.0-7.) | 05/02/2022 |
| CVE-2017-20002 | ALTO7.8 | The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty. This allows local users to login as password-less users even if they are connected by non-physical means such as SSH (hence bypassing PAM's nullok_secure configuration). This notably affects en | 17/03/2021 |
| CVE-2021-28374 | ALTO7.5 | The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowing an attacker to read user information. This may include a cleartext password in some configurations. In general, it includes the user's existence, uid and gids | 15/03/2021 |
| CVE-2020-27351 | BAIXO2.8 | Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-170. This issue affects: python-apt 1.1.0~beta1 versions prior to 1.1.0~beta1ubuntu0.16.04.10; 1.6.5ubuntu0 versions prior to 1.6.5ubuntu0.4; 2.0.0ubuntu0 versions prior to 2.0.0ubun | 10/12/2020 |
| CVE-2020-27350 | MÉDIO5.7 | APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extracttar.cc, apt-pkg/deb/debfile.cc, and apt-pkg/contrib/arfile.cc. This issue affects: apt 1.2.32ubuntu0 versions prior to 1.2.32ubuntu0.2; 1.6.12ubuntu0 versions prior to 1.6.12ubu | 10/12/2020 |
| CVE-2020-25073 | MÉDIO5.3 | FreedomBox through 20.13 allows remote attackers to obtain sensitive information from the /server-status page of the Apache HTTP Server, because a connection from the Tor onion service (or from PageKite) is considered a local connection. This affects both the freedombox and plinth packages of some Linux distributions, | 02/09/2020 |
| CVE-2020-3810 | MÉDIO5.5 | Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing specially crafted deb files. | 15/05/2020 |