NVD Description

Note: Versions mentioned in the description apply only to the upstream bzip2 package and not the bzip2 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.

Remediation

There is no fixed version for Debian:9 bzip2.

References

• https://security-tracker.debian.org/tracker/CVE-2019-12900
• https://seclists.org/bugtraq/2019/Aug/4
• https://seclists.org/bugtraq/2019/Jul/22
• https://support.f5.com/csp/article/K68713584?utm_source=f5support&utm_medium=RSS
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12900
• https://lists.debian.org/debian-lts-announce/2019/06/msg00021.html
• https://security.FreeBSD.org/advisories/FreeBSD-SA-19:18.bzip2.asc
• http://packetstormsecurity.com/files/153644/Slackware-Security-Advisory-bzip2-Updates.html
• http://packetstormsecurity.com/files/153957/FreeBSD-Security-Advisory-FreeBSD-SA-19-18.bzip2.html
• https://gitlab.com/federicomenaquintero/bzip2/commit/74de1e2e6ffc9d51ef9824db71a8ffee5962cdbc
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b@%3Cusers.kafka.apache.org%3E
• https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774@%3Cuser.flink.apache.org%3E
• https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4@%3Cuser.flink.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2019/07/msg00014.html
• https://lists.debian.org/debian-lts-announce/2019/10/msg00012.html
• https://lists.debian.org/debian-lts-announce/2019/10/msg00018.html
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00040.html
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00050.html
• http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00078.html
• http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00000.html
• https://usn.ubuntu.com/4146-1/
• https://usn.ubuntu.com/4146-2/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-12900
• https://usn.ubuntu.com/4038-1/
• https://usn.ubuntu.com/4038-2/
• https://lists.apache.org/thread.html/ra0adb9653c7de9539b93cc8434143b655f753b9f60580ff260becb2b%40%3Cusers.kafka.apache.org%3E
• https://lists.apache.org/thread.html/rce8cd8c30f60604b580ea01bebda8a671a25c9a1629f409fc24e7774%40%3Cuser.flink.apache.org%3E
• https://lists.apache.org/thread.html/rda98305669476c4d90cc8527c4deda7e449019dd1fe9936b56671dd4%40%3Cuser.flink.apache.org%3E
• https://support.f5.com/csp/article/K68713584?utm_source=f5support&amp%3Butm_medium=RSS

NVD Description

Note: Versions mentioned in the description apply only to the upstream db5.3 package and not the db5.3 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.

Remediation

There is no fixed version for Debian:9 db5.3.

References

• https://security-tracker.debian.org/tracker/CVE-2019-8457
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8457
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/
• https://www.oracle.com/security-alerts/cpujan2020.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.sqlite.org/releaselog/3_28_0.html
• https://www.sqlite.org/src/info/90acdbfce9c08858
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://security.netapp.com/advisory/ntap-20190606-0002/
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html
• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-8457
• https://usn.ubuntu.com/4004-1/
• https://usn.ubuntu.com/4004-2/
• https://usn.ubuntu.com/4019-1/
• https://usn.ubuntu.com/4019-2/
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2022-23219
• https://sourceware.org/bugzilla/show_bug.cgi?id=22542
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://security.gentoo.org/glsa/202208-24
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2022-23218
• https://sourceware.org/bugzilla/show_bug.cgi?id=28768
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://security.gentoo.org/glsa/202208-24
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2019-1010022
• https://sourceware.org/bugzilla/show_bug.cgi?id=22850
• https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3
• https://ubuntu.com/security/CVE-2019-1010022

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2019-9169
• https://kc.mcafee.com/corporate/index?page=content&id=SB10278
• https://support.f5.com/csp/article/K54823184
• https://security.gentoo.org/glsa/202006-04
• https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140
• https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142
• https://sourceware.org/bugzilla/show_bug.cgi?id=24114
• https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=583dd860d5b833037175247230a328f0050dbfe9
• https://security.netapp.com/advisory/ntap-20190315-0002/
• http://www.securityfocus.com/bid/107160
• https://usn.ubuntu.com/4416-1/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9169
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Ba=commit%3Bh=583dd860d5b833037175247230a328f0050dbfe9

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to return a pointer to a heap area that is too small, potentially leading to heap corruption.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2018-6485
• https://sourceware.org/bugzilla/show_bug.cgi?id=22343
• http://bugs.debian.org/878159
• https://security.netapp.com/advisory/ntap-20190404-0003/
• https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html
• https://access.redhat.com/errata/RHBA-2019:0327
• https://access.redhat.com/errata/RHSA-2018:3092
• http://www.securityfocus.com/bid/102912
• https://usn.ubuntu.com/4416-1/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-6485
• https://usn.ubuntu.com/4218-1/

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The malloc implementation in the GNU C Library (aka glibc or libc6), from version 2.24 to 2.26 on powerpc, and only in version 2.26 on i386, did not properly handle malloc calls with arguments close to SIZE_MAX and could return a pointer to a heap region that is smaller than requested, eventually leading to heap corruption.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2018-6551
• https://sourceware.org/bugzilla/show_bug.cgi?id=22774
• https://sourceware.org/git/?p=glibc.git;a=commit;h=8e448310d74b283c5cd02b9ed7fb997b47bf9b22
• https://security.netapp.com/advisory/ntap-20190404-0003/
• https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=8e448310d74b283c5cd02b9ed7fb997b47bf9b22

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2021-33574
• https://security.netapp.com/advisory/ntap-20210629-0005/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/
• https://security.gentoo.org/glsa/202107-07
• https://sourceware.org/bugzilla/show_bug.cgi?id=27896
• https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.

Remediation

There is no fixed version for Debian:9 krb5.

References

• https://security-tracker.debian.org/tracker/CVE-2017-11462
• http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/
• https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf
• https://bugzilla.redhat.com/show_bug.cgi?id=1488873
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-11462
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.

Remediation

There is no fixed version for Debian:9 krb5.

References

• https://security-tracker.debian.org/tracker/CVE-2017-15088
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15088
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871698
• https://github.com/krb5/krb5/commit/fbb687db1088ddd894d975996e5f6a4252b9a2b4
• https://github.com/krb5/krb5/pull/707
• https://bugzilla.redhat.com/show_bug.cgi?id=1504045
• http://www.securityfocus.com/bid/101594
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-15088

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

SQLite3 from 3.6.0 to and including 3.27.2 is vulnerable to heap out-of-bound read in the rtreenode() function when handling invalid rtree tables.

Remediation

There is no fixed version for Debian:9 sqlite3.

References

• https://security-tracker.debian.org/tracker/CVE-2019-8457
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8457
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/
• https://www.oracle.com/security-alerts/cpujan2020.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.sqlite.org/releaselog/3_28_0.html
• https://www.sqlite.org/src/info/90acdbfce9c08858
• https://www.oracle.com/security-alerts/cpuapr2020.html
• https://security.netapp.com/advisory/ntap-20190606-0002/
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00074.html
• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-8457
• https://usn.ubuntu.com/4004-1/
• https://usn.ubuntu.com/4004-2/
• https://usn.ubuntu.com/4019-1/
• https://usn.ubuntu.com/4019-2/
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OPKYSWCOM3CL66RI76TYVIG6TJ263RXH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SJPFGA45DI4F5MCF2OAACGH3HQOF4G3M/

NVD Description

Note: Versions mentioned in the description apply only to the upstream sqlite3 package and not the sqlite3 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.

Remediation

There is no fixed version for Debian:9 sqlite3.

References

• https://security-tracker.debian.org/tracker/CVE-2020-11656
• https://security.FreeBSD.org/advisories/FreeBSD-SA-20:22.sqlite.asc
• https://security.gentoo.org/glsa/202007-26
• https://www3.sqlite.org/cgi/src/info/b64674919f673602
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.oracle.com/security-alerts/cpujan2021.html
• https://www.oracle.com/security-alerts/cpujul2020.html
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://www.sqlite.org/src/info/d09f8c3621d5f7f8
• https://security.netapp.com/advisory/ntap-20200416-0001/
• https://www.tenable.com/security/tns-2021-14
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit (e.g. "0day"), running the service in question with root privileges rather than the user intended.

Remediation

There is no fixed version for Debian:9 systemd.

References

• https://security-tracker.debian.org/tracker/CVE-2017-1000082
• https://github.com/systemd/systemd/issues/6237
• http://www.openwall.com/lists/oss-security/2017/07/02/1
• http://www.securityfocus.com/bid/99507
• http://www.securitytracker.com/id/1038839

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

Remediation

There is no fixed version for Debian:9 tar.

References

• https://security-tracker.debian.org/tracker/CVE-2005-2541
• http://marc.info/?l=bugtraq&m=112327628230258&w=2
• https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c@%3Cissues.guacamole.apache.org%3E
• https://lists.apache.org/thread.html/rc713534b10f9daeee2e0990239fa407e2118e4aa9e88a7041177497c%40%3Cissues.guacamole.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called with an untrusted, crafted pattern, potentially resulting in a denial of service or disclosure of information. This occurs because atoi was used but strtoul should have been used to ensure correct calculations.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2021-35942
• https://security.netapp.com/advisory/ntap-20210827-0005/
• https://sourceware.org/bugzilla/show_bug.cgi?id=28011
• https://sourceware.org/git/?p=glibc.git;a=commit;h=5adda61f62b77384718b4c0d8336ade8f2b4b35c
• https://sourceware.org/glibc/wiki/Security%20Exceptions
• https://security.gentoo.org/glsa/202208-24
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
• https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=5adda61f62b77384718b4c0d8336ade8f2b4b35c

NVD Description

Note: Versions mentioned in the description apply only to the upstream mercurial package and not the mercurial package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.

Remediation

There is no fixed version for Debian:9 mercurial.

References

• https://security-tracker.debian.org/tracker/CVE-2018-17983
• https://www.mercurial-scm.org/repo/hg/rev/5405cb1a7901
• https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.7.2_.282018-10-01.29
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-17983

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal configuration to RCE. This attack appear to be exploitable via The user must interact with a malicious git server, (or have their traffic modified in a MITM attack).

Remediation

There is no fixed version for Debian:9 git.

References

• https://security-tracker.debian.org/tracker/CVE-2018-1000021
• http://www.batterystapl.es/2018/01/security-implications-of-ansi-escape.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-1000021

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387.

Remediation

There is no fixed version for Debian:9 git.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1354
• https://security-tracker.debian.org/tracker/CVE-2019-1354
• https://security.gentoo.org/glsa/202003-30
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1354
• https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-1354
• https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.

Remediation

There is no fixed version for Debian:9 git.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1350
• https://security-tracker.debian.org/tracker/CVE-2019-1350
• https://security.gentoo.org/glsa/202003-30
• https://security.gentoo.org/glsa/202003-42
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350
• https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-1350
• https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2019-1010023
• https://support.f5.com/csp/article/K11932200?utm_source=f5support&utm_medium=RSS
• https://sourceware.org/bugzilla/show_bug.cgi?id=22851
• http://www.securityfocus.com/bid/109167
• https://ubuntu.com/security/CVE-2019-1010023
• https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

GnuPG version 2.1.12 - 2.2.11 contains a Cross ite Request Forgery (CSRF) vulnerability in dirmngr that can result in Attacker controlled CSRF, Information Disclosure, DoS. This attack appear to be exploitable via Victim must perform a WKD request, e.g. enter an email address in the composer window of Thunderbird/Enigmail. This vulnerability appears to have been fixed in after commit 4a4bb874f63741026bd26264c43bb32b1099f060.

Remediation

There is no fixed version for Debian:9 gnupg2.

References

• https://security-tracker.debian.org/tracker/CVE-2018-1000858
• https://sektioneins.de/en/advisories/advisory-012018-gnupg-wkd.html
• https://sektioneins.de/en/blog/18-11-23-gnupg-wkd.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-1000858
• https://usn.ubuntu.com/3853-1/

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An issue was discovered in ncurses through v6.2-1. _nc_captoinfo in captoinfo.c has a heap-based buffer overflow.

Remediation

There is no fixed version for Debian:9 ncurses.

References

• https://security-tracker.debian.org/tracker/CVE-2021-39537
• http://cvsweb.netbsd.org/bsdweb.cgi/pkgsrc/devel/ncurses/patches/patch-ncurses_tinfo_captoinfo.c?rev=1.1&content-type=text/x-cvsweb-markup
• https://lists.gnu.org/archive/html/bug-ncurses/2020-08/msg00006.html
• https://lists.gnu.org/archive/html/bug-ncurses/2021-10/msg00023.html
• https://support.apple.com/kb/HT213488
• https://support.apple.com/kb/HT213443
• https://support.apple.com/kb/HT213444
• http://seclists.org/fulldisclosure/2022/Oct/41
• http://seclists.org/fulldisclosure/2022/Oct/28
• http://seclists.org/fulldisclosure/2022/Oct/43
• http://seclists.org/fulldisclosure/2022/Oct/45
• https://security.netapp.com/advisory/ntap-20230427-0012/
• https://lists.debian.org/debian-lts-announce/2023/12/msg00004.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream python2.7 package and not the python2.7 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting

Remediation

There is no fixed version for Debian:9 python2.7.

References

• https://security-tracker.debian.org/tracker/CVE-2017-17522
• https://bugs.python.org/issue32367
• http://www.securityfocus.com/bid/102207

NVD Description

Note: Versions mentioned in the description apply only to the upstream python-defaults package and not the python-defaults package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Tools/faqwiz/move-faqwiz.sh (aka the generic FAQ wizard moving tool) in Python 2.4.5 might allow local users to overwrite arbitrary files via a symlink attack on a tmp$RANDOM.tmp temporary file. NOTE: there may not be common usage scenarios in which tmp$RANDOM.tmp is located in an untrusted directory.

Remediation

There is no fixed version for Debian:9 python-defaults.

References

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=498899
• https://security-tracker.debian.org/tracker/CVE-2008-4108
• http://marc.info/?l=oss-security&m=122148330903513&w=2
• http://marc.info/?l=oss-security&m=122152861617434&w=2
• http://securityreason.com/securityalert/4274
• http://www.vupen.com/english/advisories/2008/2659
• http://xforce.iss.net/xforce/xfdb/45161
• https://bugzilla.redhat.com/show_bug.cgi?id=462326
• http://www.securityfocus.com/bid/31184
• http://www.securitytracker.com/id?1020904
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45161

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy(), this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore, this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2020-6096
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPYXTDOOB4PQGTYAMZAZNJIB3FF6YQXI/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URXOIA2LDUKHQXK4BE55BQBRI6ZZG3Y6/
• https://security.gentoo.org/glsa/202101-20
• https://sourceware.org/bugzilla/show_bug.cgi?id=25620
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1019
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPYXTDOOB4PQGTYAMZAZNJIB3FF6YQXI/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/URXOIA2LDUKHQXK4BE55BQBRI6ZZG3Y6/

NVD Description

Note: Versions mentioned in the description apply only to the upstream lz4 package and not the lz4 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states "only a few specific / uncommon usages of the API are at risk."

Remediation

There is no fixed version for Debian:9 lz4.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17543
• https://security-tracker.debian.org/tracker/CVE-2019-17543
• https://lists.apache.org/thread.html/25015588b770d67470b7ba7ea49a305d6735dd7f00eabe7d50ec1e17@%3Cissues.arrow.apache.org%3E
• https://lists.apache.org/thread.html/793012683dc0fa6819b7c2560e6cf990811014c40c7d75412099c357@%3Cissues.arrow.apache.org%3E
• https://lists.apache.org/thread.html/9ff0606d16be2ab6a81619e1c9e23c3e251756638e36272c8c8b7fa3@%3Cissues.arrow.apache.org%3E
• https://lists.apache.org/thread.html/f0038c4fab2ee25aee849ebeff6b33b3aa89e07ccfb06b5c87b36316@%3Cissues.arrow.apache.org%3E
• https://lists.apache.org/thread.html/f506bc371d4a068d5d84d7361293568f61167d3a1c3e91f0def2d7d3@%3Cdev.arrow.apache.org%3E
• https://github.com/lz4/lz4/compare/v1.9.1...v1.9.2
• https://github.com/lz4/lz4/issues/801
• https://github.com/lz4/lz4/pull/756
• https://github.com/lz4/lz4/pull/760
• https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15941
• https://lists.apache.org/thread.html/r0fb226357e7988a241b06b93bab065bcea2eb38658b382e485960e26@%3Cissues.kudu.apache.org%3E
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://lists.apache.org/thread.html/543302d55e2d2da4311994e9b0debdc676bf3fd05e1a2be3407aa2d6@%3Cissues.arrow.apache.org%3E
• https://lists.apache.org/thread.html/r4068ba81066792f2b4d208b39c4c4713c5d4c79bd8cb6c1904af5720@%3Cissues.kudu.apache.org%3E
• https://lists.apache.org/thread.html/r7bc72200f94298bc9a0e35637f388deb53467ca4b2e2ad1ff66d8960@%3Cissues.kudu.apache.org%3E
• https://www.oracle.com//security-alerts/cpujul2021.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00069.html
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00070.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-17543
• https://security.netapp.com/advisory/ntap-20210723-0001/
• https://lists.apache.org/thread.html/25015588b770d67470b7ba7ea49a305d6735dd7f00eabe7d50ec1e17%40%3Cissues.arrow.apache.org%3E
• https://lists.apache.org/thread.html/543302d55e2d2da4311994e9b0debdc676bf3fd05e1a2be3407aa2d6%40%3Cissues.arrow.apache.org%3E
• https://lists.apache.org/thread.html/793012683dc0fa6819b7c2560e6cf990811014c40c7d75412099c357%40%3Cissues.arrow.apache.org%3E
• https://lists.apache.org/thread.html/9ff0606d16be2ab6a81619e1c9e23c3e251756638e36272c8c8b7fa3%40%3Cissues.arrow.apache.org%3E
• https://lists.apache.org/thread.html/f0038c4fab2ee25aee849ebeff6b33b3aa89e07ccfb06b5c87b36316%40%3Cissues.arrow.apache.org%3E
• https://lists.apache.org/thread.html/f506bc371d4a068d5d84d7361293568f61167d3a1c3e91f0def2d7d3%40%3Cdev.arrow.apache.org%3E
• https://lists.apache.org/thread.html/r0fb226357e7988a241b06b93bab065bcea2eb38658b382e485960e26%40%3Cissues.kudu.apache.org%3E
• https://lists.apache.org/thread.html/r4068ba81066792f2b4d208b39c4c4713c5d4c79bd8cb6c1904af5720%40%3Cissues.kudu.apache.org%3E
• https://lists.apache.org/thread.html/r7bc72200f94298bc9a0e35637f388deb53467ca4b2e2ad1ff66d8960%40%3Cissues.kudu.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream bash package and not the bash package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support "saved UID" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use "enable -f" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.

Remediation

There is no fixed version for Debian:9 bash.

References

• https://security-tracker.debian.org/tracker/CVE-2019-18276
• https://security.netapp.com/advisory/ntap-20200430-0003/
• https://security.gentoo.org/glsa/202105-34
• https://github.com/bminor/bash/commit/951bdaad7a18cc0dc1036bba86b18b90874d39ff
• http://packetstormsecurity.com/files/155498/Bash-5.0-Patch-11-Privilege-Escalation.html
• https://www.youtube.com/watch?v=-wGtxJ8opa8
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-18276
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
• https://www.exploit-db.com/exploits/47726

NVD Description

Note: Versions mentioned in the description apply only to the upstream e2fsprogs package and not the e2fsprogs package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem.

Remediation

There is no fixed version for Debian:9 e2fsprogs.

References

• https://security-tracker.debian.org/tracker/CVE-2022-1304
• https://bugzilla.redhat.com/show_bug.cgi?id=2069726
• https://access.redhat.com/errata/RHSA-2022:7720
• https://access.redhat.com/errata/RHSA-2022:8361
• https://access.redhat.com/security/cve/CVE-2022-1304

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder C:\.git, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set GIT_PS1_SHOWDIRTYSTATE are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in C:\.git\config. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder .git on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend GIT_CEILING_DIRECTORIES to cover the parent directory of the user profile, e.g. C:\Users if the user profile is located in C:\Users\my-user-name.

Remediation

There is no fixed version for Debian:9 git.

References

• https://security-tracker.debian.org/tracker/CVE-2022-24765
• https://github.com/git-for-windows/git/security/advisories/GHSA-vw2c-22j4-2fh2
• https://git-scm.com/book/en/v2/Appendix-A%3A-Git-in-Other-Environments-Git-in-Bash
• https://git-scm.com/docs/git#Documentation/git.txt-codeGITCEILINGDIRECTORIEScode
• http://www.openwall.com/lists/oss-security/2022/04/12/7
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5PTN5NYEHYN2OQSHSAMCNICZNK2U4QH6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BENQYTDGUL6TF3UALY6GSIEXIHUIYNWM/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLP42KIZ6HACTVZMZLJLFJQ4W2XYT27M/
• https://support.apple.com/kb/HT213261
• http://seclists.org/fulldisclosure/2022/May/31
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TRZG5CDUQ27OWTPC5MQOR4UASNXHWEZS/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDI325LOO2XBDDKLINOAQJEG6MHAURZE/
• https://lists.debian.org/debian-lts-announce/2022/12/msg00025.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DIKWISWUDFT2FAITYIA6372BVLH3OOOC/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YROCMBWYFKRSS64PO6FUNM6L7LKBUKVW/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HVOLER2PIGMHPQMDGG4RDE2KZB74QLA2/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UDZRZAL7QULOB6V7MKT66MOMWJLBJPX4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PTN5NYEHYN2OQSHSAMCNICZNK2U4QH6/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BENQYTDGUL6TF3UALY6GSIEXIHUIYNWM/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDI325LOO2XBDDKLINOAQJEG6MHAURZE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIKWISWUDFT2FAITYIA6372BVLH3OOOC/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVOLER2PIGMHPQMDGG4RDE2KZB74QLA2/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLP42KIZ6HACTVZMZLJLFJQ4W2XYT27M/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TRZG5CDUQ27OWTPC5MQOR4UASNXHWEZS/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDZRZAL7QULOB6V7MKT66MOMWJLBJPX4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YROCMBWYFKRSS64PO6FUNM6L7LKBUKVW/
• https://security.gentoo.org/glsa/202312-15

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The string component in the GNU C Library (aka glibc or libc6) through 2.28, when running on the x32 architecture, incorrectly attempts to use a 64-bit register for size_t in assembly codes, which can lead to a segmentation fault or possibly unspecified other impact, as demonstrated by a crash in __memmove_avx_unaligned_erms in sysdeps/x86_64/multiarch/memmove-vec-unaligned-erms.S during a memcpy.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2019-6488
• https://security.gentoo.org/glsa/202006-04
• https://sourceware.org/bugzilla/show_bug.cgi?id=24097
• http://www.securityfocus.com/bid/106671

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was found in glibc. An off-by-one buffer overflow and underflow in getcwd() may lead to memory corruption when the size of the buffer is exactly 1. A local attacker who can control the input buffer and size passed to getcwd() in a setuid program could use this flaw to potentially execute arbitrary code and escalate their privileges on the system.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2021-3999
• https://www.openwall.com/lists/oss-security/2022/01/24/4
• https://access.redhat.com/security/cve/CVE-2021-3999
• https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e
• https://sourceware.org/bugzilla/show_bug.cgi?id=28769
• https://bugzilla.redhat.com/show_bug.cgi?id=2024637
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
• https://security.netapp.com/advisory/ntap-20221104-0001/
• https://access.redhat.com/errata/RHSA-2022:0896
• https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=23e0e8f5f1fb5ed150253d986ecccdc90c2dcd5e

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2018-1000001
• https://www.exploit-db.com/exploits/43775/
• https://www.exploit-db.com/exploits/44889/
• https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/
• https://security.netapp.com/advisory/ntap-20190404-0003/
• http://seclists.org/oss-sec/2018/q1/38
• https://access.redhat.com/errata/RHSA-2018:0805
• http://www.securityfocus.com/bid/102525
• http://www.securitytracker.com/id/1040162
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-1000001
• https://usn.ubuntu.com/3534-1/
• https://usn.ubuntu.com/3536-1/
• https://www.exploit-db.com/exploits/44889

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Remediation

There is no fixed version for Debian:9 openssh.

References

• https://security-tracker.debian.org/tracker/CVE-2020-15778
• https://security.netapp.com/advisory/ntap-20200731-0007/
• https://github.com/cpandya2909/CVE-2020-15778/
• https://news.ycombinator.com/item?id=25005567
• https://www.openssh.com/security.html
• https://github.com/cpandya2909/CVE-2020-15778#example
• https://security.gentoo.org/glsa/202212-06

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre3 package and not the pcre3 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.

Remediation

There is no fixed version for Debian:9 pcre3.

References

• https://security-tracker.debian.org/tracker/CVE-2017-7245
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7245
• https://security.gentoo.org/glsa/201710-25
• https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c/
• https://access.redhat.com/errata/RHSA-2018:2486
• http://www.securityfocus.com/bid/97067
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-7245

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre3 package and not the pcre3 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.

Remediation

There is no fixed version for Debian:9 pcre3.

References

• https://security-tracker.debian.org/tracker/CVE-2017-7246
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7246
• https://security.gentoo.org/glsa/201710-25
• https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c/
• https://access.redhat.com/errata/RHSA-2018:2486
• http://www.securityfocus.com/bid/97067
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-7246

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

CPAN 2.28 allows Signature Verification Bypass.

Remediation

There is no fixed version for Debian:9 perl.

References

• https://security-tracker.debian.org/tracker/CVE-2020-16156
• https://metacpan.org/pod/distribution/CPAN/scripts/cpan
• https://blog.hackeriet.no/cpan-signature-verification-vulnerabilities/
• http://blogs.perl.org/users/neilb/2021/11/addressing-cpan-vulnerabilities-related-to-checksums.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SD6RYOJII7HRJ6WVORFNVTYNOFY5JDXN/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SZ32AJIV4RHJMLWLU5QULGKMMIHYOMDC/

NVD Description

Note: Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).

Remediation

There is no fixed version for Debian:9 shadow.

References

• https://security-tracker.debian.org/tracker/CVE-2019-19882
• https://security.gentoo.org/glsa/202008-09
• https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
• https://github.com/shadow-maint/shadow/pull/199
• https://github.com/void-linux/void-packages/pull/17580
• https://bugs.archlinux.org/task/64836
• https://bugs.gentoo.org/702252

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

systemd-tmpfiles in systemd through 237 mishandles symlinks present in non-terminal path components, which allows local users to obtain ownership of arbitrary files via vectors involving creation of a directory and a file under that directory, and later replacing that directory with a symlink. This occurs even if the fs.protected_symlinks sysctl is turned on.

Remediation

There is no fixed version for Debian:9 systemd.

References

• https://security-tracker.debian.org/tracker/CVE-2018-6954
• https://github.com/systemd/systemd/issues/7986
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00062.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-6954
• https://usn.ubuntu.com/3816-1/
• https://usn.ubuntu.com/3816-2/
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.

Remediation

There is no fixed version for Debian:9 systemd.

References

• https://security-tracker.debian.org/tracker/CVE-2019-3843
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JXQAKSTMABZ46EVCRMW62DHWYHTTFES/
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://security.netapp.com/advisory/ntap-20190619-0002/
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3843
• http://www.securityfocus.com/bid/108116
• https://usn.ubuntu.com/4269-1/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-3843
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5JXQAKSTMABZ46EVCRMW62DHWYHTTFES/

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

systemd-tmpfiles in systemd before 237 attempts to support ownership/permission changes on hardlinked files even if the fs.protected_hardlinks sysctl is turned off, which allows local users to bypass intended access restrictions via vectors involving a hard link to a file for which the user lacks write access, as demonstrated by changing the ownership of the /etc/passwd file.

Remediation

There is no fixed version for Debian:9 systemd.

References

• https://security-tracker.debian.org/tracker/CVE-2017-18078
• https://lists.debian.org/debian-lts-announce/2019/04/msg00022.html
• https://www.exploit-db.com/exploits/43935/
• https://github.com/systemd/systemd/issues/7736
• http://packetstormsecurity.com/files/146184/systemd-Local-Privilege-Escalation.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• http://lists.opensuse.org/opensuse-updates/2018-02/msg00109.html
• https://www.openwall.com/lists/oss-security/2018/01/29/4
• http://www.openwall.com/lists/oss-security/2018/01/29/3
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.

Remediation

There is no fixed version for Debian:9 systemd.

References

• https://security-tracker.debian.org/tracker/CVE-2019-3844
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://security.netapp.com/advisory/ntap-20190619-0002/
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844
• http://www.securityfocus.com/bid/108096
• https://usn.ubuntu.com/4269-1/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-3844
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

runuser in util-linux allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Debian:9 util-linux.

References

• https://security-tracker.debian.org/tracker/CVE-2016-2779
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=815922
• http://www.openwall.com/lists/oss-security/2016/02/27/1
• http://www.openwall.com/lists/oss-security/2016/02/27/2
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2779

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

git_connect_git in connect.c in Git before 2.30.1 allows a repository path to contain a newline character, which may result in unexpected cross-protocol requests, as demonstrated by the git://localhost:1234/%0d%0a%0d%0aGET%20/%20HTTP/1.1 substring.

Remediation

There is no fixed version for Debian:9 git.

References

• https://security-tracker.debian.org/tracker/CVE-2021-40330
• https://github.com/git/git/commit/a02ea577174ab8ed18f847cf1693f213e0b9c473
• https://github.com/git/git/compare/v2.30.0...v2.30.1
• https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The --mirror documentation for Git through 2.35.1 does not mention the availability of deleted content, aka the "GitBleed" issue. This could present a security risk if information-disclosure auditing processes rely on a clone operation without the --mirror option.

Remediation

There is no fixed version for Debian:9 git.

References

• https://security-tracker.debian.org/tracker/CVE-2022-24975
• https://wwws.nightwatchcybersecurity.com/2022/02/11/gitbleed/
• https://github.com/git/git/blob/2dc94da3744bfbbf145eca587a0f5ff480cc5867/Documentation/git-clone.txt#L185-L191

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS (i.e. the default file systems on Windows and macOS). Note that clean/smudge filters have to be configured for that. Git for Windows configures Git LFS by default, and is therefore vulnerable. The problem has been patched in the versions published on Tuesday, March 9th, 2021. As a workaound, if symbolic link support is disabled in Git (e.g. via git config --global core.symlinks false), the described attack won't work. Likewise, if no clean/smudge filters such as Git LFS are configured globally (i.e. before cloning), the attack is foiled. As always, it is best to avoid cloning repositories from untrusted sources. The earliest impacted version is 2.14.2. The fix versions are: 2.30.1, 2.29.3, 2.28.1, 2.27.1, 2.26.3, 2.25.5, 2.24.4, 2.23.4, 2.22.5, 2.21.4, 2.20.5, 2.19.6, 2.18.5, 2.17.62.17.6.

Remediation

There is no fixed version for Debian:9 git.

References

• https://security-tracker.debian.org/tracker/CVE-2021-21300
• https://github.com/git/git/security/advisories/GHSA-8prw-h3cq-mghm
• https://support.apple.com/kb/HT212320
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BBPNGLQSYJHLZZ37BO42YY6S5OTIF4L4/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LCLJJLKKMS5WRFO6C475AOUZTWQLIARX/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LMXX2POK5X576BSDWSXGU7EIK6I72ERU/
• http://seclists.org/fulldisclosure/2021/Apr/60
• https://security.gentoo.org/glsa/202104-01
• http://packetstormsecurity.com/files/163978/Git-LFS-Clone-Command-Execution.html
• https://github.com/git/git/commit/684dd4c2b414bcf648505e74498a608f28de4592
• https://git-scm.com/docs/gitattributes#_filter
• https://git-scm.com/docs/git-config#Documentation/git-config.txt-coresymlinks
• https://lore.kernel.org/git/xmqqim6019yd.fsf@gitster.c.googlers.com/
• http://www.openwall.com/lists/oss-security/2021/03/09/3
• https://lists.debian.org/debian-lts-announce/2022/10/msg00014.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBPNGLQSYJHLZZ37BO42YY6S5OTIF4L4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCLJJLKKMS5WRFO6C475AOUZTWQLIARX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LMXX2POK5X576BSDWSXGU7EIK6I72ERU/
• https://lore.kernel.org/git/xmqqim6019yd.fsf%40gitster.c.googlers.com/

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'.

Remediation

There is no fixed version for Debian:9 git.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1351
• https://security-tracker.debian.org/tracker/CVE-2019-1351
• https://security.gentoo.org/glsa/202003-30
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1351
• https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-1351
• https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2009-5155
• https://support.f5.com/csp/article/K64119434
• https://support.f5.com/csp/article/K64119434?utm_source=f5support&utm_medium=RSS
• http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272
• https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793
• https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806
• https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238
• https://sourceware.org/bugzilla/show_bug.cgi?id=11053
• https://sourceware.org/bugzilla/show_bug.cgi?id=18986
• https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192b0499afe3c672
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://security.netapp.com/advisory/ntap-20190315-0002/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2009-5155
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=eb04c21373e2a2885f3d52ff192b0499afe3c672
• https://support.f5.com/csp/article/K64119434?utm_source=f5support&amp%3Butm_medium=RSS

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2021-3326
• https://security.netapp.com/advisory/ntap-20210304-0007/
• https://sourceware.org/bugzilla/show_bug.cgi?id=27256
• https://sourceware.org/git/?p=glibc.git;a=commit;h=7d88c6142c6efc160c0ee5e4f85cde382c072888
• http://www.openwall.com/lists/oss-security/2021/01/28/2
• https://security.gentoo.org/glsa/202107-07
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
• https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=7d88c6142c6efc160c0ee5e4f85cde382c072888

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2019-9192
• https://support.f5.com/csp/article/K26346590?utm_source=f5support&utm_medium=RSS
• https://sourceware.org/bugzilla/show_bug.cgi?id=24269
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9192
• https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2018-20796
• https://support.f5.com/csp/article/K26346590?utm_source=f5support&utm_medium=RSS
• https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141
• https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html
• https://security.netapp.com/advisory/ntap-20190315-0002/
• http://www.securityfocus.com/bid/107160
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-20796
• https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

GnuPG 2.2.4 and 2.2.5 does not enforce a configuration in which key certification requires an offline master Certify key, which results in apparently valid certifications that occurred only with access to a signing subkey.

Remediation

There is no fixed version for Debian:9 gnupg2.

References

• https://security-tracker.debian.org/tracker/CVE-2018-9234
• https://dev.gnupg.org/T3844
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-9234
• https://usn.ubuntu.com/3675-1/

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.

Remediation

There is no fixed version for Debian:9 gnupg2.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14855
• https://security-tracker.debian.org/tracker/CVE-2019-14855
• https://dev.gnupg.org/T4755
• https://lists.gnupg.org/pipermail/gnupg-announce/2019q4/000442.html
• https://rwc.iacr.org/2020/slides/Leurent.pdf
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14855
• https://usn.ubuntu.com/4516-1/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-14855

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

Remediation

There is no fixed version for Debian:9 krb5.

References

• https://security-tracker.debian.org/tracker/CVE-2018-5709
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709
• https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Integer%20Overflow
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5709
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Libgcrypt before 1.8.8 and 1.9.x before 1.9.3 mishandles ElGamal encryption because it lacks exponent blinding to address a side-channel attack against mpi_powm, and the window size is not chosen appropriately. This, for example, affects use of ElGamal in OpenPGP.

Remediation

There is no fixed version for Debian:9 libgcrypt20.

References

• https://security-tracker.debian.org/tracker/CVE-2021-33560
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BKKTOIGFW2SGN3DO2UHHVZ7MJSYN4AAB/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R7OAPCUGPF3VLA7QAJUQSL255D4ITVTL/
• https://dev.gnupg.org/rCe8b7f10be275bcedb5fc05ed4837a89bfd605c61
• https://dev.gnupg.org/T5305
• https://dev.gnupg.org/T5328
• https://dev.gnupg.org/T5466
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://lists.debian.org/debian-lts-announce/2021/06/msg00021.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://security.gentoo.org/glsa/202210-13
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BKKTOIGFW2SGN3DO2UHHVZ7MJSYN4AAB/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R7OAPCUGPF3VLA7QAJUQSL255D4ITVTL/

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

Remediation

There is no fixed version for Debian:9 libgcrypt20.

References

• https://security-tracker.debian.org/tracker/CVE-2018-6829
• https://github.com/weikengchen/attack-on-libgcrypt-elgamal
• https://github.com/weikengchen/attack-on-libgcrypt-elgamal/wiki
• https://lists.gnupg.org/pipermail/gcrypt-devel/2018-February/004394.html
• https://www.oracle.com/security-alerts/cpujan2020.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

Remediation

There is no fixed version for Debian:9 openldap.

References

• https://security-tracker.debian.org/tracker/CVE-2015-3276
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1238322
• http://rhn.redhat.com/errata/RHSA-2015-2131.html
• http://www.securitytracker.com/id/1034221
• https://access.redhat.com/errata/RHSA-2015:2131
• https://access.redhat.com/security/cve/CVE-2015-3276

NVD Description

Note: Versions mentioned in the description apply only to the upstream openldap package and not the openldap package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

Remediation

There is no fixed version for Debian:9 openldap.

References

• https://security-tracker.debian.org/tracker/CVE-2017-17740
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17740
• http://www.openldap.org/its/index.cgi/Incoming?id=8759
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365
• https://www.oracle.com/security-alerts/cpuapr2022.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The scp client in OpenSSH 8.2 incorrectly sends duplicate responses to the server upon a utimes system call failure, which allows a malicious unprivileged user on the remote server to overwrite arbitrary files in the client's download directory by creating a crafted subdirectory anywhere on the remote server. The victim must use the command scp -rp to download a file hierarchy containing, anywhere inside, this crafted subdirectory. NOTE: the vendor points out that "this attack can achieve no more than a hostile peer is already able to achieve within the scp protocol" and "utimes does not fail under normal circumstances.

Remediation

There is no fixed version for Debian:9 openssh.

References

• https://security-tracker.debian.org/tracker/CVE-2020-12062
• https://github.com/openssh/openssh-portable/commit/955854cafca88e0cdcd3d09ca1ad4ada465364a1
• https://github.com/openssh/openssh-portable/commit/aad87b88fc2536b1ea023213729aaf4eaabe1894
• https://www.openssh.com/txt/release-8.3
• https://www.openwall.com/lists/oss-security/2020/05/27/1

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre3 package and not the pcre3 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

libpcre in PCRE before 8.43 allows a subject buffer over-read in JIT when UTF is disabled, and \X or \R has more than one fixed quantifier, a related issue to CVE-2019-20454.

Remediation

There is no fixed version for Debian:9 pcre3.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-20838
• https://security-tracker.debian.org/tracker/CVE-2019-20838
• https://support.apple.com/kb/HT211931
• https://support.apple.com/kb/HT212147
• http://seclists.org/fulldisclosure/2020/Dec/32
• http://seclists.org/fulldisclosure/2021/Feb/14
• https://bugs.gentoo.org/717920
• https://www.pcre.org/original/changelog.txt
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream pcre3 package and not the pcre3 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.

Remediation

There is no fixed version for Debian:9 pcre3.

References

• https://security-tracker.debian.org/tracker/CVE-2017-11164
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
• http://openwall.com/lists/oss-security/2017/07/11/3
• http://www.securityfocus.com/bid/99575
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-11164
• http://www.openwall.com/lists/oss-security/2023/04/11/1
• http://www.openwall.com/lists/oss-security/2023/04/12/1
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream perl package and not the perl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

_is_safe in the File::Temp module for Perl does not properly handle symlinks.

Remediation

There is no fixed version for Debian:9 perl.

References

• https://security-tracker.debian.org/tracker/CVE-2011-4116
• https://github.com/Perl-Toolchain-Gang/File-Temp/issues/14
• https://rt.cpan.org/Public/Bug/Display.html?id=69106
• https://seclists.org/oss-sec/2011/q4/238
• http://www.openwall.com/lists/oss-security/2011/11/04/2
• http://www.openwall.com/lists/oss-security/2011/11/04/4

NVD Description

Note: Versions mentioned in the description apply only to the upstream python2.7 package and not the python2.7 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service (resource consumption) via a ZIP bomb.

Remediation

There is no fixed version for Debian:9 python2.7.

References

• https://security-tracker.debian.org/tracker/CVE-2019-9674
• https://bugs.python.org/issue36260
• https://bugs.python.org/issue36462
• https://github.com/python/cpython/blob/master/Lib/zipfile.py
• https://python-security.readthedocs.io/security.html#archives-and-zip-bomb
• https://www.python.org/news/security/
• https://security.netapp.com/advisory/ntap-20200221-0003/
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html
• https://usn.ubuntu.com/4428-1/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9674

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.

Remediation

There is no fixed version for Debian:9 tar.

References

• https://security-tracker.debian.org/tracker/CVE-2019-9923
• http://git.savannah.gnu.org/cgit/tar.git/commit/?id=cb07844454d8cc9fb21f53ace75975f91185a120
• http://savannah.gnu.org/bugs/?55369
• https://bugs.launchpad.net/ubuntu/+source/tar/+bug/1810241
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-9923
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream ncurses package and not the ncurses package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library.

Remediation

There is no fixed version for Debian:9 ncurses.

References

• https://security-tracker.debian.org/tracker/CVE-2022-29458
• https://lists.gnu.org/archive/html/bug-ncurses/2022-04/msg00016.html
• https://lists.gnu.org/archive/html/bug-ncurses/2022-04/msg00014.html
• https://support.apple.com/kb/HT213488
• https://lists.debian.org/debian-lts-announce/2022/10/msg00037.html
• http://seclists.org/fulldisclosure/2022/Oct/41
• http://seclists.org/fulldisclosure/2022/Oct/28

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An out-of-bounds write vulnerability was found in glibc before 2.31 when handling signal trampolines on PowerPC. Specifically, the backtrace function did not properly check the array bounds when storing the frame address, resulting in a denial of service or potential code execution. The highest threat from this vulnerability is to system availability.

Remediation

There is no fixed version for Debian:9 glibc.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-1751
• https://security-tracker.debian.org/tracker/CVE-2020-1751
• https://security.gentoo.org/glsa/202006-04
• https://sourceware.org/bugzilla/show_bug.cgi?id=25423
• https://security.netapp.com/advisory/ntap-20200430-0002/
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1751
• https://usn.ubuntu.com/4416-1/

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A use-after-free vulnerability introduced in glibc upstream version 2.14 was found in the way the tilde expansion was carried out. Directory paths containing an initial tilde followed by a valid username were affected by this issue. A local attacker could exploit this flaw by creating a specially crafted path that, when processed by the glob function, would potentially lead to arbitrary code execution. This was fixed in version 2.32.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2020-1752
• https://sourceware.org/bugzilla/show_bug.cgi?id=25414
• https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ddc650e9b3dc916eab417ce9f79e67337b05035c
• https://security.gentoo.org/glsa/202101-20
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
• https://security.netapp.com/advisory/ntap-20200511-0005/
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1752
• https://usn.ubuntu.com/4416-1/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-1752
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
• https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• https://sourceware.org/git/gitweb.cgi?p=glibc.git%3Bh=ddc650e9b3dc916eab417ce9f79e67337b05035c

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.

Remediation

There is no fixed version for Debian:9 openssh.

References

• https://security-tracker.debian.org/tracker/CVE-2021-41617
• https://bugzilla.suse.com/show_bug.cgi?id=1190975
• https://security.netapp.com/advisory/ntap-20211014-0004/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6XJIONMHMKZDTMH6BQR5TNLF2WDCGWED/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KVI7RWM2JLNMWTOFK6BDUSGNOIPZYPUT/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/W44V2PFQH5YLRN6ZJTVRKAD7CU6CYYET/
• https://www.openssh.com/security.html
• https://www.openssh.com/txt/release-8.8
• https://www.openwall.com/lists/oss-security/2021/09/26/1
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujul2022.html
• https://www.starwindsoftware.com/security/sw-20220805-0001/
• https://www.tenable.com/plugins/nessus/154174
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XJIONMHMKZDTMH6BQR5TNLF2WDCGWED/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVI7RWM2JLNMWTOFK6BDUSGNOIPZYPUT/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W44V2PFQH5YLRN6ZJTVRKAD7CU6CYYET/
• https://www.debian.org/security/2023/dsa-5586
• https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server (or Man-in-The-Middle attacker) can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred.

Remediation

There is no fixed version for Debian:9 openssh.

References

• https://security-tracker.debian.org/tracker/CVE-2019-6110
• https://www.exploit-db.com/exploits/46193/
• https://security.gentoo.org/glsa/201903-16
• https://cvsweb.openbsd.org/src/usr.bin/ssh/progressmeter.c
• https://cvsweb.openbsd.org/src/usr.bin/ssh/scp.c
• https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt
• https://security.netapp.com/advisory/ntap-20190213-0001/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-6110
• https://cert-portal.siemens.com/productcert/pdf/ssa-412672.pdf
• https://www.exploit-db.com/exploits/46516

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

Remediation

There is no fixed version for Debian:9 systemd.

References

• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2020-13776
• https://security-tracker.debian.org/tracker/CVE-2020-13776
• https://security.netapp.com/advisory/ntap-20200611-0003/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63/
• https://github.com/systemd/systemd/issues/15985
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63/

NVD Description

Note: Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Debian:9 coreutils.

References

• https://security-tracker.debian.org/tracker/CVE-2016-2781
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
• http://www.openwall.com/lists/oss-security/2016/02/28/2
• http://www.openwall.com/lists/oss-security/2016/02/28/3
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-2781
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream curl package and not the curl package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

When curl is instructed to download content using the metalink feature, thecontents is verified against a hash provided in the metalink XML file.The metalink XML file points out to the client how to get the same contentfrom a set of different URLs, potentially hosted by different servers and theclient can then download the file from one or several of them. In a serial orparallel manner.If one of the servers hosting the contents has been breached and the contentsof the specific file on that server is replaced with a modified payload, curlshould detect this when the hash of the file mismatches after a completeddownload. It should remove the contents and instead try getting the contentsfrom another URL. This is not done, and instead such a hash mismatch is onlymentioned in text and the potentially malicious content is kept in the file ondisk.

Remediation

There is no fixed version for Debian:9 curl.

References

• https://security-tracker.debian.org/tracker/CVE-2021-22922
• https://security.netapp.com/advisory/ntap-20210902-0003/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/
• https://hackerone.com/reports/1213175
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cdev.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc@%3Cusers.kafka.apache.org%3E
• https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cdev.kafka.apache.org%3E
• https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7@%3Cusers.kafka.apache.org%3E
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://security.gentoo.org/glsa/202212-01
• https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cdev.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r61db8e7dcb56dc000a5387a88f7a473bacec5ee01b9ff3f55308aacc%40%3Cusers.kafka.apache.org%3E
• https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cdev.kafka.apache.org%3E
• https://lists.apache.org/thread.html/rbf4ce74b0d1fa9810dec50ba3ace0caeea677af7c27a97111c06ccb7%40%3Cusers.kafka.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRUCW2UVNYUDZF72DQLFQR4PJEC6CF7V/

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils package and not the elfutils package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An attempted excessive memory allocation was discovered in the function read_long_names in elf_begin.c in libelf in elfutils 0.174. Remote attackers could leverage this vulnerability to cause a denial-of-service via crafted elf input, which leads to an out-of-memory exception. NOTE: The maintainers believe this is not a real issue, but instead a "warning caused by ASAN because the allocation is big. By setting ASAN_OPTIONS=allocator_may_return_null=1 and running the reproducer, nothing happens."

Remediation

There is no fixed version for Debian:9 elfutils.

References

• https://security-tracker.debian.org/tracker/CVE-2019-7148
• https://sourceware.org/bugzilla/show_bug.cgi?id=24085

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils package and not the elfutils package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by eu-nm.

Remediation

There is no fixed version for Debian:9 elfutils.

References

• https://security-tracker.debian.org/tracker/CVE-2019-7149
• https://lists.debian.org/debian-lts-announce/2019/02/msg00036.html
• https://sourceware.org/bugzilla/show_bug.cgi?id=24102
• https://sourceware.org/ml/elfutils-devel/2019-q1/msg00068.html
• https://access.redhat.com/errata/RHSA-2019:2197
• https://access.redhat.com/errata/RHSA-2019:3575
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-7149
• https://usn.ubuntu.com/4012-1/

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A NULL pointer dereference flaw was found in GnuTLS. As Nettle's hash update functions internally call memcpy, providing zero-length input may cause undefined behavior. This flaw leads to a denial of service after authentication in rare circumstances.

Remediation

There is no fixed version for Debian:9 gnutls28.

References

• https://security-tracker.debian.org/tracker/CVE-2021-4209
• https://gitlab.com/gnutls/gnutls/-/issues/1306
• https://access.redhat.com/security/cve/CVE-2021-4209
• https://gitlab.com/gnutls/gnutls/-/merge_requests/1503
• https://bugzilla.redhat.com/show_bug.cgi?id=2044156
• https://gitlab.com/gnutls/gnutls/-/commit/3db352734472d851318944db13be73da61300568
• https://security.netapp.com/advisory/ntap-20220915-0005/

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5 package and not the krb5 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function "strlen" is getting a "NULL" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client.

Remediation

There is no fixed version for Debian:9 krb5.

References

• https://security-tracker.debian.org/tracker/CVE-2018-5710
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5710
• https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service%28DoS%29
• https://github.com/poojamnit/Kerberos-V5-1.16-Vulnerabilities/tree/master/Denial%20Of%20Service(DoS)
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-5710

NVD Description

Note: Versions mentioned in the description apply only to the upstream python2.7 package and not the python2.7 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.

Remediation

There is no fixed version for Debian:9 python2.7.

References

• https://security-tracker.debian.org/tracker/CVE-2020-8492
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/
• https://security.gentoo.org/glsa/202005-09
• https://github.com/python/cpython/pull/18284
• https://bugs.python.org/issue39503
• https://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html
• https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5@%3Ccommits.cassandra.apache.org%3E
• https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da@%3Ccommits.cassandra.apache.org%3E
• https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html
• https://security.netapp.com/advisory/ntap-20200221-0001/
• http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00003.html
• https://usn.ubuntu.com/4333-2/
• https://usn.ubuntu.com/4333-1/
• https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
• https://lists.apache.org/thread.html/rdb31a608dd6758c6093fd645aea3fbf022dd25b37109b6aaea5bc0b5%40%3Ccommits.cassandra.apache.org%3E
• https://lists.apache.org/thread.html/rfec113c733162b39633fd86a2d0f34bf42ac35f711b3ec1835c774da%40%3Ccommits.cassandra.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7WOKDEXLYW5UQ4S7PA7E37IITOC7C56J/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/APGWEMYZIY5VHLCSZ3HD67PA5Z2UQFGH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

Remediation

There is no fixed version for Debian:9 expat.

References

• https://security-tracker.debian.org/tracker/CVE-2013-0340
• https://support.apple.com/kb/HT212804
• https://support.apple.com/kb/HT212805
• https://support.apple.com/kb/HT212807
• https://support.apple.com/kb/HT212814
• https://support.apple.com/kb/HT212815
• https://support.apple.com/kb/HT212819
• http://seclists.org/fulldisclosure/2021/Sep/33
• http://seclists.org/fulldisclosure/2021/Sep/34
• http://seclists.org/fulldisclosure/2021/Sep/35
• http://seclists.org/fulldisclosure/2021/Sep/38
• http://seclists.org/fulldisclosure/2021/Sep/39
• http://seclists.org/fulldisclosure/2021/Sep/40
• https://security.gentoo.org/glsa/201701-21
• http://securitytracker.com/id?1028213
• https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d@%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702@%3Cusers.openoffice.apache.org%3E
• http://www.openwall.com/lists/oss-security/2021/10/07/4
• http://openwall.com/lists/oss-security/2013/02/22/3
• http://www.openwall.com/lists/oss-security/2013/04/12/6
• http://www.securityfocus.com/bid/58233
• http://www.osvdb.org/90634
• http://seclists.org/fulldisclosure/2021/Oct/61
• http://seclists.org/fulldisclosure/2021/Oct/63
• http://seclists.org/fulldisclosure/2021/Oct/62
• https://lists.apache.org/thread.html/r41eca5f4f09e74436cbb05dec450fc2bef37b5d3e966aa7cc5fada6d%40%3Cannounce.apache.org%3E
• https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.

Remediation

There is no fixed version for Debian:9 libgcrypt20.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13627
• https://security-tracker.debian.org/tracker/CVE-2019-13627
• https://lists.debian.org/debian-lts-announce/2019/09/msg00024.html
• https://lists.debian.org/debian-lts-announce/2020/01/msg00001.html
• https://security.gentoo.org/glsa/202003-32
• https://github.com/gpg/libgcrypt/releases/tag/libgcrypt-1.8.5
• https://minerva.crocs.fi.muni.cz/
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00060.html
• http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00018.html
• http://www.openwall.com/lists/oss-security/2019/10/02/2
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-13627
• https://usn.ubuntu.com/4236-1/
• https://usn.ubuntu.com/4236-2/
• https://usn.ubuntu.com/4236-3/

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

sshd in OpenSSH 4 on Debian GNU/Linux, and the 20070303 OpenSSH snapshot, allows remote authenticated users to obtain access to arbitrary SELinux roles by appending a :/ (colon slash) sequence, followed by the role name, to the username.

Remediation

There is no fixed version for Debian:9 openssh.

References

• https://security-tracker.debian.org/tracker/CVE-2008-3234
• https://www.exploit-db.com/exploits/6094
• http://www.securityfocus.com/bid/30276
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44037

NVD Description

Note: Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

Remediation

There is no fixed version for Debian:9 shadow.

References

• https://security-tracker.debian.org/tracker/CVE-2007-5686
• http://www.securityfocus.com/archive/1/482129/100/100/threaded
• http://www.securityfocus.com/archive/1/482857/100/0/threaded
• https://issues.rpath.com/browse/RPL-1825
• http://secunia.com/advisories/27215
• http://www.securityfocus.com/bid/26048
• http://www.vupen.com/english/advisories/2007/3474

NVD Description

Note: Versions mentioned in the description apply only to the upstream python2.7 package and not the python2.7 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \r\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.

Remediation

There is no fixed version for Debian:9 python2.7.

References

• https://security-tracker.debian.org/tracker/CVE-2019-18348
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/
• https://bugs.python.org/issue30458#msg347282
• https://www.oracle.com/security-alerts/cpuoct2020.html
• https://lists.debian.org/debian-lts-announce/2020/07/msg00011.html
• https://security.netapp.com/advisory/ntap-20191107-0004/
• https://bugzilla.redhat.com/show_bug.cgi?id=1727276
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00041.html
• https://usn.ubuntu.com/4333-1/
• https://usn.ubuntu.com/4333-2/
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-18348
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4X3HW5JRZ7GCPSR7UHJOLD7AWLTQCDVR/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A5NSAX4SC3V64PGZUPH7PRDLSON34Q5A/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JCPGLTTOBB3QEARDX4JOYURP6ELNNA2V/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M34WOYCDKTDE5KLUACE2YIEH7D37KHRX/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UESGYI5XDAHJBATEZN3MHNDUBDH47AS6/

NVD Description

Note: Versions mentioned in the description apply only to the upstream systemd package and not the systemd package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DCHP ACK packets to reconfigure the server.

Remediation

There is no fixed version for Debian:9 systemd.

References

• https://security-tracker.debian.org/tracker/CVE-2020-13529
• https://security.netapp.com/advisory/ntap-20210625-0005/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/42TMJVNYRY65B4QCJICBYOEIVZV3KUYI/
• https://security.gentoo.org/glsa/202107-48
• https://talosintelligence.com/vulnerability_reports/TALOS-2020-1142
• http://www.openwall.com/lists/oss-security/2021/08/04/2
• http://www.openwall.com/lists/oss-security/2021/08/17/3
• http://www.openwall.com/lists/oss-security/2021/09/07/3
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/42TMJVNYRY65B4QCJICBYOEIVZV3KUYI/

NVD Description

Note: Versions mentioned in the description apply only to the upstream wget package and not the wget package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Remediation

There is no fixed version for Debian:9 wget.

References

• https://security-tracker.debian.org/tracker/CVE-2021-31879
• https://security.netapp.com/advisory/ntap-20210618-0002/
• https://mail.gnu.org/archive/html/bug-wget/2021-02/msg00002.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The DNS stub resolver in the GNU C Library (aka glibc or libc6) before version 2.26, when EDNS support is enabled, will solicit large UDP responses from name servers, potentially simplifying off-path DNS spoofing attacks due to IP fragmentation.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2017-12132
• https://arxiv.org/pdf/1205.4011.pdf
• https://sourceware.org/bugzilla/show_bug.cgi?id=21361
• https://access.redhat.com/errata/RHSA-2018:0805
• http://www.securityfocus.com/bid/100598
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-12132

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2015-8985
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779392
• https://security.gentoo.org/glsa/201908-06
• http://www.openwall.com/lists/oss-security/2017/02/14/9
• http://www.securityfocus.com/bid/76916
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2015-8985

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2016-10228
• https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21
• https://sourceware.org/bugzilla/show_bug.cgi?id=26224
• https://security.gentoo.org/glsa/202101-20
• https://sourceware.org/bugzilla/show_bug.cgi?id=19519
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
• http://openwall.com/lists/oss-security/2017/03/01/10
• http://www.securityfocus.com/bid/96525
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-10228
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The iconv feature in the GNU C Library (aka glibc or libc6) through 2.32, when processing invalid multi-byte input sequences in the EUC-KR encoding, may have a buffer over-read.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2019-25013
• https://security.netapp.com/advisory/ntap-20210205-0004/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4Y6TX47P47KABSFOL26FLDNVCWXDKDEZ/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TVCUNLQ3HXGS4VPUQKWTJGRAW2KTFGXS/
• https://sourceware.org/bugzilla/show_bug.cgi?id=24973
• https://sourceware.org/git/?p=glibc.git;a=commit;h=ee7a3144c9922808181009b7b3e50e852fb4999b
• https://lists.apache.org/thread.html/r32d767ac804e9b8aad4355bb85960a6a1385eab7afff549a5e98660f@%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r448bb851cc8e6e3f93f3c28c70032b37062625d81214744474ac49e7@%3Cdev.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r4806a391091e082bdea17266452ca656ebc176e51bb3932733b3a0a2@%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r499e4f96d0b5109ef083f2feccd33c51650c1b7d7068aa3bd47efca9@%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r5af4430421bb6f9973294691a7904bbd260937e9eef96b20556f43ff@%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r750eee18542bc02bd8350861c424ee60a9b9b225568fa09436a37ece@%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r7a2e94adfe0a2f0a1d42e4927e8c32ecac97d37db9cb68095fe9ddbc@%3Cdev.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rd2354f9ccce41e494fbadcbc5ad87218de6ec0fff8a7b54c8462226c@%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772@%3Cdev.mina.apache.org%3E
• https://security.gentoo.org/glsa/202107-07
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
• https://lists.apache.org/thread.html/r32d767ac804e9b8aad4355bb85960a6a1385eab7afff549a5e98660f%40%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r448bb851cc8e6e3f93f3c28c70032b37062625d81214744474ac49e7%40%3Cdev.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r4806a391091e082bdea17266452ca656ebc176e51bb3932733b3a0a2%40%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r499e4f96d0b5109ef083f2feccd33c51650c1b7d7068aa3bd47efca9%40%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r5af4430421bb6f9973294691a7904bbd260937e9eef96b20556f43ff%40%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r750eee18542bc02bd8350861c424ee60a9b9b225568fa09436a37ece%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r7a2e94adfe0a2f0a1d42e4927e8c32ecac97d37db9cb68095fe9ddbc%40%3Cdev.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rd2354f9ccce41e494fbadcbc5ad87218de6ec0fff8a7b54c8462226c%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4Y6TX47P47KABSFOL26FLDNVCWXDKDEZ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TVCUNLQ3HXGS4VPUQKWTJGRAW2KTFGXS/
• https://sourceware.org/git/?p=glibc.git%3Ba=commit%3Bh=ee7a3144c9922808181009b7b3e50e852fb4999b

NVD Description

Note: Versions mentioned in the description apply only to the upstream openssh package and not the openssh package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The client side in OpenSSH 5.7 through 8.4 has an Observable Discrepancy leading to an information leak in the algorithm negotiation. This allows man-in-the-middle attackers to target initial connection attempts (where no host key for the server has been cached by the client). NOTE: some reports state that 8.5 and 8.6 are also affected.

Remediation

There is no fixed version for Debian:9 openssh.

References

• https://security-tracker.debian.org/tracker/CVE-2020-14145
• https://security.netapp.com/advisory/ntap-20200709-0004/
• https://security.gentoo.org/glsa/202105-35
• https://anongit.mindrot.org/openssh.git/commit/?id=b3855ff053f5078ec3d3c653cdaedefaa5fc362d
• https://docs.ssh-mitm.at/CVE-2020-14145.html
• https://github.com/openssh/openssh-portable/compare/V_8_3_P1...V_8_4_P1
• https://github.com/ssh-mitm/ssh-mitm/blob/master/ssh_proxy_server/plugins/session/cve202014145.py
• https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/
• http://www.openwall.com/lists/oss-security/2020/12/02/1

NVD Description

Note: Versions mentioned in the description apply only to the upstream nettle package and not the nettle package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

Remediation

There is no fixed version for Debian:9 nettle.

References

• https://security-tracker.debian.org/tracker/CVE-2018-16869
• http://cat.eyalro.net/
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16869
• http://www.securityfocus.com/bid/106092
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-16869

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnutls28 package and not the gnutls28 package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.

Remediation

There is no fixed version for Debian:9 gnutls28.

References

• https://security-tracker.debian.org/tracker/CVE-2018-16868
• http://cat.eyalro.net/
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html
• http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00068.html
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16868
• http://www.securityfocus.com/bid/106080
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-16868

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils package and not the elfutils package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

libdw in elfutils 0.173 checks the end of the attributes list incorrectly in dwarf_getabbrev in dwarf_getabbrev.c and dwarf_hasattr in dwarf_hasattr.c, leading to a heap-based buffer over-read and an application crash.

Remediation

There is no fixed version for Debian:9 elfutils.

References

• https://security-tracker.debian.org/tracker/CVE-2018-16403
• https://sourceware.org/bugzilla/show_bug.cgi?id=23529
• https://sourceware.org/git/?p=elfutils.git;a=commit;h=6983e59b727458a6c64d9659c85f08218bc4fcda
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00052.html
• https://access.redhat.com/errata/RHSA-2019:2197
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2018-16403
• https://usn.ubuntu.com/4012-1/
• https://sourceware.org/git/?p=elfutils.git%3Ba=commit%3Bh=6983e59b727458a6c64d9659c85f08218bc4fcda

NVD Description

Note: Versions mentioned in the description apply only to the upstream git package and not the git package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

Git through 2.14.2 mishandles layers of tree objects, which allows remote attackers to cause a denial of service (memory consumption) via a crafted repository, aka a Git bomb. This can also have an impact of disk consumption; however, an affected process typically would not survive its attempt to build the data structure in memory before writing to disk.

Remediation

There is no fixed version for Debian:9 git.

References

• https://security-tracker.debian.org/tracker/CVE-2017-15298
• https://github.com/Katee/git-bomb
• https://kate.io/blog/git-bomb/
• http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2017-15298
• https://usn.ubuntu.com/3829-1/

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2019-7309
• https://security.gentoo.org/glsa/202006-04
• https://sourceware.org/bugzilla/show_bug.cgi?id=24155
• https://sourceware.org/ml/libc-alpha/2019-02/msg00041.html
• http://www.securityfocus.com/bid/106835
• http://people.ubuntu.com/~ubuntu-security/cve/CVE-2019-7309

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid multi-byte input sequences in IBM1364, IBM1371, IBM1388, IBM1390, and IBM1399 encodings, fails to advance the input state, which could lead to an infinite loop in applications, resulting in a denial of service, a different vulnerability from CVE-2016-10228.

Remediation

There is no fixed version for Debian:9 glibc.

References

• https://security-tracker.debian.org/tracker/CVE-2020-27618
• https://security.netapp.com/advisory/ntap-20210401-0006/
• https://sourceware.org/bugzilla/show_bug.cgi?id=19519#c21
• https://sourceware.org/bugzilla/show_bug.cgi?id=26224
• https://security.gentoo.org/glsa/202107-07
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Debian. See How to fix? for Debian:9 relevant fixed versions and status.

The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.

Remediation

There is no fixed version for Debian:9 glibc.