Vulnerability report for Docker rocker/shiny-verse:latest

Vulnerabilities	68 via 208 paths
Dependencies	420
Source	Docker
Target OS	ubuntu:24.04

Test your Docker Hub image against our market leading vulnerability database Sign up for free

Severity

Critical
1
High
8
Medium
41
Low
18

Status

Open
68
Patched
0
Ignored
0

OS binaries

critical severity

Race Condition

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Race Condition in the vm module with the timeout option. An attacker can access secrets like tokens or passwords to leak or cause data corruption by exploiting a race condition in buffer allocation logic that allows zero-fill toggle to remain disabled when vm module timeouts interrupt execution.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Race Condition vulnerability report

high severity

Uncaught Exception

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in the SignTraits::DeriveBits() function, which incorrectly invokes ThrowException() based on user inputs when executing in a background thread. This allows an attacker to trigger a runtime crash.

Note: The cryptographic operations involved are commonly applied to untrusted input.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.
Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade node to version 20.19.2, 22.15.1, 23.11.1, 24.0.2 or higher.

References

Uncaught Exception vulnerability report

high severity

Uncaught Exception

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception due to the unhandled TLSSocket error ECONNRESET. An attacker can cause application crash by passing malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data.

Note:

This issue primary affects applications without explicit error handlers to secure sockets.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Uncaught Exception vulnerability report

high severity

Uncaught Exception

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in Node.js HTTP request handling. The flaw triggers when an incoming request includes a header named __proto__ and the server application accesses req.headersDistinct. This causes dest["__proto__"] to incorrectly resolve to Object.prototype, resulting in an uncaught TypeError when .push() is called on a non-array. Because this exception is thrown synchronously inside a property getter, standard error listeners cannot intercept it. This causes the Node.js process to crash unless every access is explicitly wrapped in a try/catch block.

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

Uncaught Exception vulnerability report

high severity

Directory Traversal

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Directory Traversal in the path.join function. An attacker can bypass the path traversal protection and access restricted files by crafting specific path inputs that leverage Windows reserved driver names such as CON, PRN, and AUX.

Note: This issue only affects Windows systems and is a result of an incomplete fix for CVE-2025-23084

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade node to version 20.19.4, 22.17.1, 24.4.1 or higher.

References

Directory Traversal vulnerability report

high severity

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Vulnerable module: node
Introduced through: node@20.17.0
Fixed in: 20.20.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Reliance on Undefined, Unspecified, or Implementation-Defined Behavior due to a flaw in error handling when async_hooks (or AsyncLocalStorage) is enabled. Normally, a "Maximum call stack size exceeded" error (stack overflow) is catchable by try-catch blocks or uncaughtException handlers. However, if this error occurs while an async_hooks callback is on the stack (which happens frequently in frameworks like Next.js or when using APM tools), Node.js treats it as a fatal error. Remote attackers can trigger this crash by sending payloads that cause deep recursion (e.g., deeply nested JSON objects), leading to a Denial of Service.

Notes:

Node.js 24.x and 25.x are less affected if using only AsyncLocalStorage, as they use a newer V8 feature that avoids this hook mechanism;
The patch improves recoverability in one edge case, but it does not remove the broader risk. Recovery from space exhaustion is unspecified, best‑effort behavior and is not a reliable basis for availability or security.

PoC

import { createHook } from 'node:async_hooks';

// This simulates what APM tools do
createHook({ init() {} }).enable();

function recursive() {
  new Promise(() => {}); // Creates async context
  return recursive();
}

try {
  recursive();
} catch (err) {
  console.log('This never runs', err);
}

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior vulnerability report

high severity

Uncaught Exception

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in the TLS module when a TLS server is configured with pskCallback or ALPNCallback. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Uncaught Exception vulnerability report

high severity

Uncaught Exception

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in the TLS module when a SNICallback throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error.

Note:

This is caused by an incomplete fix for CVE-2026-21637.

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

Uncaught Exception vulnerability report

high severity

UNIX Symbolic Link (Symlink) Following

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to UNIX Symbolic Link (Symlink) Following in the fs.symlink() function. An attacker can escape the allowed path and read/write sensitive files by chaining directories and symlinks, bypassing --allow-fs-read and --allow-fs-write restrictions.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

UNIX Symbolic Link (Symlink) Following vulnerability report

medium severity

Directory Traversal

Vulnerable module: pam/libpam-modules
Introduced through: pam/libpam-modules@1.5.3-5ubuntu5.5, pam/libpam-modules-bin@1.5.3-5ubuntu5.5 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › pam/libpam-modules@1.5.3-5ubuntu5.5
Introduced through: rocker/shiny-verse@latest › pam/libpam-modules-bin@1.5.3-5ubuntu5.5
Introduced through: rocker/shiny-verse@latest › pam/libpam-runtime@1.5.3-5ubuntu5.5
Introduced through: rocker/shiny-verse@latest › pam/libpam0g@1.5.3-5ubuntu5.5

NVD Description

Note: Versions mentioned in the description apply only to the upstream pam package and not the pam package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Remediation

There is no fixed version for Ubuntu:24.04 pam.

References

Directory Traversal vulnerability report

medium severity

Memory Leak

Vulnerable module: freeglut/libglut3.12
Introduced through: freeglut/libglut3.12@3.4.0-1build1
Fixed in: 3.4.0-1ubuntu0.1~esm1

Detailed paths

Introduced through: rocker/shiny-verse@latest › freeglut/libglut3.12@3.4.0-1build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream freeglut package and not the freeglut package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry function.

Remediation

Upgrade Ubuntu:24.04 freeglut to version 3.4.0-1ubuntu0.1~esm1 or higher.

References

Memory Leak vulnerability report

medium severity

Memory Leak

Vulnerable module: freeglut/libglut3.12
Introduced through: freeglut/libglut3.12@3.4.0-1build1
Fixed in: 3.4.0-1ubuntu0.1~esm1

Detailed paths

Introduced through: rocker/shiny-verse@latest › freeglut/libglut3.12@3.4.0-1build1

NVD Description

freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function.

Remediation

Upgrade Ubuntu:24.04 freeglut to version 3.4.0-1ubuntu0.1~esm1 or higher.

References

Memory Leak vulnerability report

medium severity

new

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: libcap2
Introduced through: libcap2@1:2.66-5ubuntu2.2
Fixed in: 1:2.66-5ubuntu2.4

Detailed paths

Introduced through: rocker/shiny-verse@latest › libcap2@1:2.66-5ubuntu2.2

NVD Description

Note: Versions mentioned in the description apply only to the upstream libcap2 package and not the libcap2 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the cap_set_file() function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

Remediation

Upgrade Ubuntu:24.04 libcap2 to version 1:2.66-5ubuntu2.4 or higher.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the ReadFileUtf8 internal binding, which fails to clean up pointers in uv_fs_s.file. UTF-16 path buffers leak memory, which can lead to denial of service.

Note:

CVE-2025-23122 is a duplicate of this vulnerability.

Remediation

Upgrade node to version 20.19.2, 22.15.1 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

HTTP Request Smuggling

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling in the llhttp implementation, when handing HTTP/1 headers terminated with \r\n\rX instead of the required \r\n\r\n. This allows attackers to bypass proxy-based access controls and submit unauthorized requests.

Remediation

Upgrade node to version 20.19.2 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity

Inefficient Algorithmic Complexity

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the V8 JavaScript engine due to the string hashing mechanism predictably hashing integer-like strings directly to their numeric values. An attacker can exploit this by sending maliciously crafted payloads containing many colliding strings to endpoints that process user input (most commonly via JSON.parse()). This causes massive hash collisions within V8's internal string table, drastically degrading the performance of the Node.js process and resulting in a Denial of Service (DoS).

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

Inefficient Algorithmic Complexity vulnerability report

medium severity

Missing Release of Memory after Effective Lifetime

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in HTTP/2 servers that triggers when a client sends WINDOW_UPDATE frames on stream 0 that cause the flow control window to exceed $2^{31}-1$ . Although the server responds with a GOAWAY frame, it fails to properly clean up the Http2Session object. An unauthenticated remote attacker can exploit this by continuously opening connections and sending these crafted frames. This forces the server to leak memory indefinitely, eventually causing resource exhaustion and a Denial of Service (DoS).

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

Missing Release of Memory after Effective Lifetime vulnerability report

medium severity

Divide By Zero

Vulnerable module: pixman/libpixman-1-0
Introduced through: pixman/libpixman-1-0@0.42.2-1build1 and pixman/libpixman-1-dev@0.42.2-1build1

Detailed paths

Introduced through: rocker/shiny-verse@latest › pixman/libpixman-1-0@0.42.2-1build1
Introduced through: rocker/shiny-verse@latest › pixman/libpixman-1-dev@0.42.2-1build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream pixman package and not the pixman package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c.

Remediation

There is no fixed version for Ubuntu:24.04 pixman.

References

Divide By Zero vulnerability report

medium severity

Observable Timing Discrepancy

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Observable Timing Discrepancy due to the crypto_hmac.cc module using memcmp(), a non-constant-time comparison function to validate user-provided HMAC signatures, rather than the timing-safe equivalents used elsewhere in the codebase. An attacker capable of taking high-resolution timing measurements can use the application as a timing oracle. Because the comparison leaks timing information proportional to the number of matching bytes, the attacker can iteratively infer the expected HMAC values, ultimately enabling them to forge valid Message Authentication Codes (MACs).

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

Observable Timing Discrepancy vulnerability report

medium severity

Open Redirect

Vulnerable module: wget
Introduced through: wget@1.21.4-1ubuntu4.1

Detailed paths

Introduced through: rocker/shiny-verse@latest › wget@1.21.4-1ubuntu4.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream wget package and not the wget package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Remediation

There is no fixed version for Ubuntu:24.04 wget.

References

Open Redirect vulnerability report

medium severity

new

CVE-2025-69651

Vulnerable module: binutils
Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an invalid pointer free when processing a crafted ELF binary with malformed relocation or symbol data. If dump_relocations returns early due to parsing errors, the internal all_relocations array may remain partially uninitialized. Later, process_got_section_contents() may attempt to free an invalid r_symbol pointer, triggering memory corruption checks in glibc and causing the program to terminate with SIGABRT. No evidence of further memory corruption or code execution was observed; the impact is limited to denial of service. NOTE: this is disputed by third parties because the observed behavior occurred only in pre-release code and did not affect any tagged version.

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

CVE-2025-69651 vulnerability report

medium severity

Out-of-Bounds

Vulnerable module: binutils
Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch.

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

Out-of-Bounds vulnerability report

medium severity

Algorithmic Complexity

Vulnerable module: expat/libexpat1
Introduced through: expat/libexpat1@2.6.1-2ubuntu0.4 and expat/libexpat1-dev@2.6.1-2ubuntu0.4

Detailed paths

Introduced through: rocker/shiny-verse@latest › expat/libexpat1@2.6.1-2ubuntu0.4
Introduced through: rocker/shiny-verse@latest › expat/libexpat1-dev@2.6.1-2ubuntu0.4

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

Remediation

There is no fixed version for Ubuntu:24.04 expat.

References

Algorithmic Complexity vulnerability report

medium severity

new

Unrestricted Upload of File with Dangerous Type

Vulnerable module: tar
Introduced through: tar@1.35+dfsg-3build1

Detailed paths

Introduced through: rocker/shiny-verse@latest › tar@1.35+dfsg-3build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

Remediation

There is no fixed version for Ubuntu:24.04 tar.

References

Unrestricted Upload of File with Dangerous Type vulnerability report

medium severity

Incorrect Authorization

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Incorrect Authorization in the permission model via the fs.futimes() function due to failing to check for write permissions. A process restricted to "read-only" access can still modify a file's access and modification timestamps. While it doesn't allow changing the file's content, it can be used to obscure malicious activity by tampering with audit logs or metadata.

Note:

This is only exploitable if the attacker already has the ability to execute code on the system (within the restricted Node.js environment).

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Incorrect Authorization vulnerability report

medium severity

Missing Authorization

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Missing Authorization via the fs.realpathSync.native() function. An attacker running malicious code within a restricted Node.js environment (where --allow-fs-read is intentionally limited) can exploit this missing check to verify file existence, resolve symlink targets, and enumerate paths outside of the permitted directories, leading to unauthorized information disclosure.

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

Missing Authorization vulnerability report

medium severity

Improper Verification of Cryptographic Signature

Vulnerable module: gnupg2/dirmngr
Introduced through: gnupg2/dirmngr@2.4.4-2ubuntu17.4, gnupg2/gpg-agent@2.4.4-2ubuntu17.4 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › gnupg2/dirmngr@2.4.4-2ubuntu17.4
Introduced through: rocker/shiny-verse@latest › gnupg2/gpg-agent@2.4.4-2ubuntu17.4
Introduced through: rocker/shiny-verse@latest › gnupg2/gpgv@2.4.4-2ubuntu17.4
Introduced through: rocker/shiny-verse@latest › gnupg2/keyboxd@2.4.4-2ubuntu17.4

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Remediation

There is no fixed version for Ubuntu:24.04 gnupg2.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

new

CVE-2025-69644

Vulnerable module: binutils
Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

An issue was discovered in Binutils before 2.46. The objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed debug information. A logic flaw in the handling of DWARF location list headers can cause objdump to enter an unbounded loop and produce endless output until manually interrupted. This issue affects versions prior to the upstream fix and allows a local attacker to cause excessive resource consumption by supplying a malicious input file.

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

CVE-2025-69644 vulnerability report

medium severity

new

CVE-2025-69645

Vulnerable module: binutils
Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug information. A logic error in the handling of DWARF compilation units can result in an invalid offset_size value being used inside byte_get_little_endian, leading to an abort (SIGABRT). The issue was observed in binutils 2.44. A local attacker can trigger the crash by supplying a malicious input file.

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

CVE-2025-69645 vulnerability report

medium severity

new

CVE-2025-69646

Vulnerable module: binutils
Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

Binutils objdump contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF debug_rnglists data. A logic error in the handling of the debug_rnglists header can cause objdump to repeatedly print the same warning message and fail to terminate, resulting in an unbounded logging loop until the process is interrupted. The issue was observed in binutils 2.44. A local attacker can exploit this vulnerability by supplying a malicious input file, leading to excessive CPU and I/O usage and preventing completion of the objdump analysis.

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

CVE-2025-69646 vulnerability report

medium severity

new

CVE-2025-69647

Vulnerable module: binutils
Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF loclists data. A logic flaw in the DWARF parsing code can cause readelf to repeatedly print the same table output without making forward progress, resulting in an unbounded output loop that never terminates unless externally interrupted. A local attacker can trigger this behavior by supplying a malicious input file, causing excessive CPU and I/O usage and preventing readelf from completing its analysis.

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

CVE-2025-69647 vulnerability report

medium severity

new

CVE-2025-69648

Vulnerable module: binutils
Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

GNU Binutils thru 2.45.1 readelf contains a denial-of-service vulnerability when processing a crafted binary with malformed DWARF .debug_rnglists data. A logic flaw in the DWARF parsing path causes readelf to repeatedly print the same warning message without making forward progress, resulting in a non-terminating output loop that requires manual interruption. No evidence of memory corruption or code execution was observed.

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

CVE-2025-69648 vulnerability report

medium severity

new

CVE-2025-69652

Vulnerable module: binutils
Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

GNU Binutils thru 2.46 readelf contains a vulnerability that leads to an abort (SIGABRT) when processing a crafted ELF binary with malformed DWARF abbrev or debug information. Due to incomplete state cleanup in process_debug_info(), an invalid debug_info_p state may propagate into DWARF attribute parsing routines. When certain malformed attributes result in an unexpected data length of zero, byte_get_little_endian() triggers a fatal abort. No evidence of memory corruption or code execution was observed; the impact is limited to denial of service.

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

CVE-2025-69652 vulnerability report

medium severity

new

CVE-2026-5545

Vulnerable module: curl/libcurl4-openssl-dev
Introduced through: curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8 and curl/libcurl4t64@8.5.0-2ubuntu10.8
Fixed in: 8.5.0-2ubuntu10.9

Detailed paths

Introduced through: rocker/shiny-verse@latest › curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8
Introduced through: rocker/shiny-verse@latest › curl/libcurl4t64@8.5.0-2ubuntu10.8

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Ubuntu:24.04 curl to version 8.5.0-2ubuntu10.9 or higher.

References

http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-5545

CVE-2026-5545 vulnerability report

medium severity

new

CVE-2026-6253

Vulnerable module: curl/libcurl4-openssl-dev
Introduced through: curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8 and curl/libcurl4t64@8.5.0-2ubuntu10.8
Fixed in: 8.5.0-2ubuntu10.9

Detailed paths

Introduced through: rocker/shiny-verse@latest › curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8
Introduced through: rocker/shiny-verse@latest › curl/libcurl4t64@8.5.0-2ubuntu10.8

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Ubuntu:24.04 curl to version 8.5.0-2ubuntu10.9 or higher.

References

http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-6253

CVE-2026-6253 vulnerability report

medium severity

new

CVE-2026-6429

Vulnerable module: curl/libcurl4-openssl-dev
Introduced through: curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8 and curl/libcurl4t64@8.5.0-2ubuntu10.8
Fixed in: 8.5.0-2ubuntu10.9

Detailed paths

Introduced through: rocker/shiny-verse@latest › curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8
Introduced through: rocker/shiny-verse@latest › curl/libcurl4t64@8.5.0-2ubuntu10.8

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Ubuntu:24.04 curl to version 8.5.0-2ubuntu10.9 or higher.

References

http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-6429

CVE-2026-6429 vulnerability report

medium severity

new

CVE-2026-7168

Vulnerable module: curl/libcurl4-openssl-dev
Introduced through: curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8 and curl/libcurl4t64@8.5.0-2ubuntu10.8
Fixed in: 8.5.0-2ubuntu10.9

Detailed paths

Introduced through: rocker/shiny-verse@latest › curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8
Introduced through: rocker/shiny-verse@latest › curl/libcurl4t64@8.5.0-2ubuntu10.8

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Ubuntu:24.04 curl to version 8.5.0-2ubuntu10.9 or higher.

References

http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-7168

CVE-2026-7168 vulnerability report

medium severity

new

CVE-2026-2219

Vulnerable module: dpkg
Introduced through: dpkg@1.22.6ubuntu6.5
Fixed in: 1.22.6ubuntu6.6

Detailed paths

Introduced through: rocker/shiny-verse@latest › dpkg@1.22.6ubuntu6.5

NVD Description

Note: Versions mentioned in the description apply only to the upstream dpkg package and not the dpkg package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompressing a zstd-compressed .deb archive, which may result in denial of service (infinite loop spinning the CPU).

Remediation

Upgrade Ubuntu:24.04 dpkg to version 1.22.6ubuntu6.6 or higher.

References

CVE-2026-2219 vulnerability report

medium severity

new

CVE-2026-4046

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.39-0ubuntu8.7, glibc/libc-dev-bin@2.39-0ubuntu8.7 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › glibc/libc-bin@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/libc-dev-bin@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/libc6@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/libc6-dev@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/locales@2.39-0ubuntu8.7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.

This vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them.

Remediation

There is no fixed version for Ubuntu:24.04 glibc.

References

CVE-2026-4046 vulnerability report

medium severity

new

CVE-2026-4437

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.39-0ubuntu8.7, glibc/libc-dev-bin@2.39-0ubuntu8.7 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › glibc/libc-bin@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/libc-dev-bin@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/libc6@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/libc6-dev@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/locales@2.39-0ubuntu8.7

NVD Description

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the application to treat a non-answer section of the DNS response as a valid answer.

Remediation

There is no fixed version for Ubuntu:24.04 glibc.

References

CVE-2026-4437 vulnerability report

medium severity

new

CVE-2026-4438

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.39-0ubuntu8.7, glibc/libc-dev-bin@2.39-0ubuntu8.7 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › glibc/libc-bin@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/libc-dev-bin@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/libc6@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/libc6-dev@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/locales@2.39-0ubuntu8.7

NVD Description

Calling gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C library version 2.34 to version 2.43 could result in an invalid DNS hostname being returned to the caller in violation of the DNS specification.

Remediation

There is no fixed version for Ubuntu:24.04 glibc.

References

CVE-2026-4438 vulnerability report

medium severity

new

Out-of-bounds Read

Vulnerable module: libpng1.6/libpng-dev
Introduced through: libpng1.6/libpng-dev@1.6.43-5ubuntu0.5 and libpng1.6/libpng16-16t64@1.6.43-5ubuntu0.5
Fixed in: 1.6.43-5ubuntu0.6

Detailed paths

Introduced through: rocker/shiny-verse@latest › libpng1.6/libpng-dev@1.6.43-5ubuntu0.5
Introduced through: rocker/shiny-verse@latest › libpng1.6/libpng16-16t64@1.6.43-5ubuntu0.5

NVD Description

Note: Versions mentioned in the description apply only to the upstream libpng1.6 package and not the libpng1.6 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.6.36 through 1.6.55, an out-of-bounds read and write exists in libpng's ARM/AArch64 Neon-optimized palette expansion path. When expanding 8-bit paletted rows to RGB or RGBA, the Neon loop processes a final partial chunk without verifying that enough input pixels remain. Because the implementation works backward from the end of the row, the final iteration dereferences pointers before the start of the row buffer (OOB read) and writes expanded pixel data to the same underflowed positions (OOB write). This is reachable via normal decoding of attacker-controlled PNG input if Neon is enabled. Version 1.6.56 fixes the issue.

Remediation

Upgrade Ubuntu:24.04 libpng1.6 to version 1.6.43-5ubuntu0.6 or higher.

References

Out-of-bounds Read vulnerability report

medium severity

new

Use After Free

Vulnerable module: libpng1.6/libpng-dev
Introduced through: libpng1.6/libpng-dev@1.6.43-5ubuntu0.5 and libpng1.6/libpng16-16t64@1.6.43-5ubuntu0.5
Fixed in: 1.6.43-5ubuntu0.6

Detailed paths

Introduced through: rocker/shiny-verse@latest › libpng1.6/libpng-dev@1.6.43-5ubuntu0.5
Introduced through: rocker/shiny-verse@latest › libpng1.6/libpng16-16t64@1.6.43-5ubuntu0.5

NVD Description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. In versions 1.2.1 through 1.6.55, png_set_tRNS and png_set_PLTE each alias a heap-allocated buffer between png_struct and png_info, sharing a single allocation across two structs with independent lifetimes. The trans_alpha aliasing has been present since at least libpng 1.0, and the palette aliasing since at least 1.2.1. Both affect all prior release lines png_set_tRNS sets png_ptr->trans_alpha = info_ptr->trans_alpha (256-byte buffer) and png_set_PLTE sets info_ptr->palette = png_ptr->palette (768-byte buffer). In both cases, calling png_free_data (with PNG_FREE_TRNS or PNG_FREE_PLTE) frees the buffer through info_ptr while the corresponding png_ptr pointer remains dangling. Subsequent row-transform functions dereference and, in some code paths, write to the freed memory. A second call to png_set_tRNS or png_set_PLTE has the same effect, because both functions call png_free_data internally before reallocating the info_ptr buffer. Version 1.6.56 fixes the issue.

Remediation

Upgrade Ubuntu:24.04 libpng1.6 to version 1.6.43-5ubuntu0.6 or higher.

References

Use After Free vulnerability report

medium severity

new

Use After Free

Vulnerable module: libpng1.6/libpng-dev
Introduced through: libpng1.6/libpng-dev@1.6.43-5ubuntu0.5 and libpng1.6/libpng16-16t64@1.6.43-5ubuntu0.5
Fixed in: 1.6.43-5ubuntu0.6

Detailed paths

Introduced through: rocker/shiny-verse@latest › libpng1.6/libpng-dev@1.6.43-5ubuntu0.5
Introduced through: rocker/shiny-verse@latest › libpng1.6/libpng16-16t64@1.6.43-5ubuntu0.5

NVD Description

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From 1.0.9 to before 1.6.57, passing a pointer obtained from png_get_PLTE, png_get_tRNS, or png_get_hIST back into the corresponding setter on the same png_struct/png_info pair causes the setter to read from freed memory and copy its contents into the replacement buffer. The setter frees the internal buffer before copying from the caller-supplied pointer, which now dangles. The freed region may contain stale data (producing silently corrupted chunk metadata) or data from subsequent heap allocations (leaking unrelated heap contents into the chunk struct). This vulnerability is fixed in 1.6.57.

Remediation

Upgrade Ubuntu:24.04 libpng1.6 to version 1.6.43-5ubuntu0.6 or higher.

References

Use After Free vulnerability report

medium severity

new

Reachable Assertion

Vulnerable module: nghttp2/libnghttp2-14
Introduced through: nghttp2/libnghttp2-14@1.59.0-1ubuntu0.2
Fixed in: 1.59.0-1ubuntu0.3

Detailed paths

Introduced through: rocker/shiny-verse@latest › nghttp2/libnghttp2-14@1.59.0-1ubuntu0.2

NVD Description

Note: Versions mentioned in the description apply only to the upstream nghttp2 package and not the nghttp2 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. Prior to version 1.68.1, the nghttp2 library stops reading the incoming data when user facing public API nghttp2_session_terminate_session or nghttp2_session_terminate_session2 is called by the application. They might be called internally by the library when it detects the situation that is subject to connection error. Due to the missing internal state validation, the library keeps reading the rest of the data after one of those APIs is called. Then receiving a malformed frame that causes FRAME_SIZE_ERROR causes assertion failure. nghttp2 v1.68.1 adds missing state validation to avoid assertion failure. No known workarounds are available.

Remediation

Upgrade Ubuntu:24.04 nghttp2 to version 1.59.0-1ubuntu0.3 or higher.

References

Reachable Assertion vulnerability report

medium severity

new

CVE-2025-13462

Vulnerable module: python3.12
Introduced through: python3.12@3.12.3-1ubuntu0.12, python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.12 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › python3.12@3.12.3-1ubuntu0.12
Introduced through: rocker/shiny-verse@latest › python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.12
Introduced through: rocker/shiny-verse@latest › python3.12/libpython3.12-stdlib@3.12.3-1ubuntu0.12
Introduced through: rocker/shiny-verse@latest › python3.12/python3.12-minimal@3.12.3-1ubuntu0.12

NVD Description

Note: Versions mentioned in the description apply only to the upstream python3.12 package and not the python3.12 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

Remediation

There is no fixed version for Ubuntu:24.04 python3.12.

References

CVE-2025-13462 vulnerability report

medium severity

new

CVE-2026-2297

Vulnerable module: python3.12
Introduced through: python3.12@3.12.3-1ubuntu0.12, python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.12 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › python3.12@3.12.3-1ubuntu0.12
Introduced through: rocker/shiny-verse@latest › python3.12/libpython3.12-minimal@3.12.3-1ubuntu0.12
Introduced through: rocker/shiny-verse@latest › python3.12/libpython3.12-stdlib@3.12.3-1ubuntu0.12
Introduced through: rocker/shiny-verse@latest › python3.12/python3.12-minimal@3.12.3-1ubuntu0.12

NVD Description

The import hook in CPython that handles legacy *.pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.open_code() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.

Remediation

There is no fixed version for Ubuntu:24.04 python3.12.

References

CVE-2026-2297 vulnerability report

medium severity

new

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: sed
Introduced through: sed@4.9-2build1
Fixed in: 4.9-2ubuntu0.24.04.1

Detailed paths

Introduced through: rocker/shiny-verse@latest › sed@4.9-2build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream sed package and not the sed package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations on the same path:

resolves symlink to its target and stores the resolved path for determining when output is written,
opens the original symlink path (not the resolved one) to read the file. Between these two calls there is a race window. If an attacker atomically replaces the symlink with a different target during that window, sed will: read content from the new (attacker-chosen) symlink target and write the processed result to the path recorded in step 1. This can lead to arbitrary file overwrite with attacker-controlled content in the context of the sed process.

This issue was fixed in version 4.10.

Remediation

Upgrade Ubuntu:24.04 sed to version 4.9-2ubuntu0.24.04.1 or higher.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

medium severity

Directory Traversal

Vulnerable module: tar
Introduced through: tar@1.35+dfsg-3build1

Detailed paths

Introduced through: rocker/shiny-verse@latest › tar@1.35+dfsg-3build1

NVD Description

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.

Remediation

There is no fixed version for Ubuntu:24.04 tar.

References

Directory Traversal vulnerability report

medium severity

new

Time-of-check Time-of-use (TOCTOU)

Vulnerable module: util-linux
Introduced through: util-linux@2.39.3-9ubuntu6.5, util-linux/bsdutils@1:2.39.3-9ubuntu6.5 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › util-linux@2.39.3-9ubuntu6.5
Introduced through: rocker/shiny-verse@latest › util-linux/bsdutils@1:2.39.3-9ubuntu6.5
Introduced through: rocker/shiny-verse@latest › util-linux/libblkid-dev@2.39.3-9ubuntu6.5
Introduced through: rocker/shiny-verse@latest › util-linux/libblkid1@2.39.3-9ubuntu6.5
Introduced through: rocker/shiny-verse@latest › util-linux/libmount-dev@2.39.3-9ubuntu6.5
Introduced through: rocker/shiny-verse@latest › util-linux/libmount1@2.39.3-9ubuntu6.5
Introduced through: rocker/shiny-verse@latest › util-linux/libsmartcols1@2.39.3-9ubuntu6.5
Introduced through: rocker/shiny-verse@latest › util-linux/libuuid1@2.39.3-9ubuntu6.5
Introduced through: rocker/shiny-verse@latest › util-linux/mount@2.39.3-9ubuntu6.5
Introduced through: rocker/shiny-verse@latest › util-linux/uuid-dev@2.39.3-9ubuntu6.5

NVD Description

Note: Versions mentioned in the description apply only to the upstream util-linux package and not the util-linux package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

util-linux is a random collection of Linux utilities. Prior to version 2.41.4, a TOCTOU (Time-of-Check-Time-of-Use) vulnerability has been identified in the SUID binary /usr/bin/mount from util-linux. The mount binary, when setting up loop devices, validates the source file path with user privileges via fork() + setuid() + realpath(), but subsequently re-canonicalizes and opens it with root privileges (euid=0) without verifying that the path has not been replaced between both operations. Neither O_NOFOLLOW, nor inode comparison, nor post-open fstat() are employed. This allows a local unprivileged user to replace the source file with a symlink pointing to any root-owned file or device during the race window, causing the SUID binary to open and mount it as root. Exploitation requires an /etc/fstab entry with user,loop options whose path points to a directory where the attacker has write permission, and that /usr/bin/mount has the SUID bit set (the default configuration on virtually all Linux distributions). The impact is unauthorized read access to root-protected files and block devices, including backup images, disk volumes, and any file containing a valid filesystem. This issue has been patched in version 2.41.4.

Remediation

There is no fixed version for Ubuntu:24.04 util-linux.

References

Time-of-check Time-of-use (TOCTOU) vulnerability report

low severity

Out-of-Bounds

Vulnerable module: elfutils/libelf1t64
Introduced through: elfutils/libelf1t64@0.190-1.1ubuntu0.1

Detailed paths

Introduced through: rocker/shiny-verse@latest › elfutils/libelf1t64@0.190-1.1ubuntu0.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils package and not the elfutils package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.

Remediation

There is no fixed version for Ubuntu:24.04 elfutils.

References

Out-of-Bounds vulnerability report

low severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: glibc/libc-bin
Introduced through: glibc/libc-bin@2.39-0ubuntu8.7, glibc/libc-dev-bin@2.39-0ubuntu8.7 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › glibc/libc-bin@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/libc-dev-bin@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/libc6@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/libc6-dev@2.39-0ubuntu8.7
Introduced through: rocker/shiny-verse@latest › glibc/locales@2.39-0ubuntu8.7

NVD Description

sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.

Remediation

There is no fixed version for Ubuntu:24.04 glibc.

References

Allocation of Resources Without Limits or Throttling vulnerability report

low severity

Buffer Overflow

Vulnerable module: icu/icu-devtools
Introduced through: icu/icu-devtools@74.2-1ubuntu3.1, icu/libicu-dev@74.2-1ubuntu3.1 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › icu/icu-devtools@74.2-1ubuntu3.1
Introduced through: rocker/shiny-verse@latest › icu/libicu-dev@74.2-1ubuntu3.1
Introduced through: rocker/shiny-verse@latest › icu/libicu74@74.2-1ubuntu3.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream icu package and not the icu package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

Remediation

There is no fixed version for Ubuntu:24.04 icu.

References

Buffer Overflow vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: cairo/libcairo-gobject2
Introduced through: cairo/libcairo-gobject2@1.18.0-3build1, cairo/libcairo-script-interpreter2@1.18.0-3build1 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › cairo/libcairo-gobject2@1.18.0-3build1
Introduced through: rocker/shiny-verse@latest › cairo/libcairo-script-interpreter2@1.18.0-3build1
Introduced through: rocker/shiny-verse@latest › cairo/libcairo2@1.18.0-3build1
Introduced through: rocker/shiny-verse@latest › cairo/libcairo2-dev@1.18.0-3build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream cairo package and not the cairo package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function).

Remediation

There is no fixed version for Ubuntu:24.04 cairo.

References

Out-of-bounds Write vulnerability report

low severity

Reachable Assertion

Vulnerable module: cairo/libcairo-gobject2
Introduced through: cairo/libcairo-gobject2@1.18.0-3build1, cairo/libcairo-script-interpreter2@1.18.0-3build1 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › cairo/libcairo-gobject2@1.18.0-3build1
Introduced through: rocker/shiny-verse@latest › cairo/libcairo-script-interpreter2@1.18.0-3build1
Introduced through: rocker/shiny-verse@latest › cairo/libcairo2@1.18.0-3build1
Introduced through: rocker/shiny-verse@latest › cairo/libcairo2-dev@1.18.0-3build1

NVD Description

An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.

Remediation

There is no fixed version for Ubuntu:24.04 cairo.

References

Reachable Assertion vulnerability report

low severity

Improper Input Validation

Vulnerable module: coreutils
Introduced through: coreutils@9.4-3ubuntu6.2

Detailed paths

Introduced through: rocker/shiny-verse@latest › coreutils@9.4-3ubuntu6.2

NVD Description

Note: Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Ubuntu:24.04 coreutils.

References

Improper Input Validation vulnerability report

low severity

Allocation of Resources Without Limits or Throttling

Vulnerable module: binutils
Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

Allocation of Resources Without Limits or Throttling vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: cairo/libcairo-gobject2
Introduced through: cairo/libcairo-gobject2@1.18.0-3build1, cairo/libcairo-script-interpreter2@1.18.0-3build1 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › cairo/libcairo-gobject2@1.18.0-3build1
Introduced through: rocker/shiny-verse@latest › cairo/libcairo-script-interpreter2@1.18.0-3build1
Introduced through: rocker/shiny-verse@latest › cairo/libcairo2@1.18.0-3build1
Introduced through: rocker/shiny-verse@latest › cairo/libcairo2-dev@1.18.0-3build1

NVD Description

Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.

Remediation

There is no fixed version for Ubuntu:24.04 cairo.

References

NULL Pointer Dereference vulnerability report

low severity

Improper Resource Shutdown or Release

Vulnerable module: elfutils/libelf1t64
Introduced through: elfutils/libelf1t64@0.190-1.1ubuntu0.1

Detailed paths

Introduced through: rocker/shiny-verse@latest › elfutils/libelf1t64@0.190-1.1ubuntu0.1

NVD Description

A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue.

Remediation

There is no fixed version for Ubuntu:24.04 elfutils.

References

Improper Resource Shutdown or Release vulnerability report

low severity

Memory Leak

Vulnerable module: binutils
Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

Memory Leak vulnerability report

low severity

Out-of-bounds Write

Vulnerable module: gnupg2/dirmngr
Introduced through: gnupg2/dirmngr@2.4.4-2ubuntu17.4, gnupg2/gpg-agent@2.4.4-2ubuntu17.4 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › gnupg2/dirmngr@2.4.4-2ubuntu17.4
Introduced through: rocker/shiny-verse@latest › gnupg2/gpg-agent@2.4.4-2ubuntu17.4
Introduced through: rocker/shiny-verse@latest › gnupg2/gpgv@2.4.4-2ubuntu17.4
Introduced through: rocker/shiny-verse@latest › gnupg2/keyboxd@2.4.4-2ubuntu17.4

NVD Description

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

Remediation

There is no fixed version for Ubuntu:24.04 gnupg2.

References

Out-of-bounds Write vulnerability report

low severity

Missing Authorization

Vulnerable module: node
Introduced through: node@20.17.0

Detailed paths

Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Missing Authorization via FileHandle.chmod or FileHandle.chown functions which can use a "read-only" file descriptor to change the owner and permissions of a file.

Notes:

This is only exploitable for users using the experimental permission when the --allow-fs-write flag is used;
This is caused by an incomplete fix for CVE-2024-36137.

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

Missing Authorization vulnerability report

low severity

new

CVE-2026-4873

Vulnerable module: curl/libcurl4-openssl-dev
Introduced through: curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8 and curl/libcurl4t64@8.5.0-2ubuntu10.8
Fixed in: 8.5.0-2ubuntu10.9

Detailed paths

Introduced through: rocker/shiny-verse@latest › curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8
Introduced through: rocker/shiny-verse@latest › curl/libcurl4t64@8.5.0-2ubuntu10.8

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Ubuntu:24.04 curl to version 8.5.0-2ubuntu10.9 or higher.

References

http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-4873

CVE-2026-4873 vulnerability report

low severity

new

CVE-2026-5773

Vulnerable module: curl/libcurl4-openssl-dev
Introduced through: curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8 and curl/libcurl4t64@8.5.0-2ubuntu10.8
Fixed in: 8.5.0-2ubuntu10.9

Detailed paths

Introduced through: rocker/shiny-verse@latest › curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8
Introduced through: rocker/shiny-verse@latest › curl/libcurl4t64@8.5.0-2ubuntu10.8

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Ubuntu:24.04 curl to version 8.5.0-2ubuntu10.9 or higher.

References

http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-5773

CVE-2026-5773 vulnerability report

low severity

new

CVE-2026-6276

Vulnerable module: curl/libcurl4-openssl-dev
Introduced through: curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8 and curl/libcurl4t64@8.5.0-2ubuntu10.8
Fixed in: 8.5.0-2ubuntu10.9

Detailed paths

Introduced through: rocker/shiny-verse@latest › curl/libcurl4-openssl-dev@8.5.0-2ubuntu10.8
Introduced through: rocker/shiny-verse@latest › curl/libcurl4t64@8.5.0-2ubuntu10.8

NVD Description

This vulnerability has not been analyzed by NVD yet.

Remediation

Upgrade Ubuntu:24.04 curl to version 8.5.0-2ubuntu10.9 or higher.

References

http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-6276

CVE-2026-6276 vulnerability report

low severity

NULL Pointer Dereference

Vulnerable module: harfbuzz/gir1.2-harfbuzz-0.0
Introduced through: harfbuzz/gir1.2-harfbuzz-0.0@8.3.0-2build2, harfbuzz/libharfbuzz-cairo0@8.3.0-2build2 and others

Detailed paths

Introduced through: rocker/shiny-verse@latest › harfbuzz/gir1.2-harfbuzz-0.0@8.3.0-2build2
Introduced through: rocker/shiny-verse@latest › harfbuzz/libharfbuzz-cairo0@8.3.0-2build2
Introduced through: rocker/shiny-verse@latest › harfbuzz/libharfbuzz-dev@8.3.0-2build2
Introduced through: rocker/shiny-verse@latest › harfbuzz/libharfbuzz-gobject0@8.3.0-2build2
Introduced through: rocker/shiny-verse@latest › harfbuzz/libharfbuzz-icu0@8.3.0-2build2
Introduced through: rocker/shiny-verse@latest › harfbuzz/libharfbuzz-subset0@8.3.0-2build2
Introduced through: rocker/shiny-verse@latest › harfbuzz/libharfbuzz0b@8.3.0-2build2

NVD Description

Note: Versions mentioned in the description apply only to the upstream harfbuzz package and not the harfbuzz package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Remediation

There is no fixed version for Ubuntu:24.04 harfbuzz.

References

NULL Pointer Dereference vulnerability report

low severity

Covert Timing Channel

Vulnerable module: libgcrypt20
Introduced through: libgcrypt20@1.10.3-2build1

Detailed paths

Introduced through: rocker/shiny-verse@latest › libgcrypt20@1.10.3-2build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

Remediation

There is no fixed version for Ubuntu:24.04 libgcrypt20.

References

Covert Timing Channel vulnerability report

low severity

CVE-2024-56433

Vulnerable module: shadow/login
Introduced through: shadow/login@1:4.13+dfsg1-4ubuntu3.2 and shadow/passwd@1:4.13+dfsg1-4ubuntu3.2

Detailed paths

Introduced through: rocker/shiny-verse@latest › shadow/login@1:4.13+dfsg1-4ubuntu3.2
Introduced through: rocker/shiny-verse@latest › shadow/passwd@1:4.13+dfsg1-4ubuntu3.2

NVD Description

Note: Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

Remediation

There is no fixed version for Ubuntu:24.04 shadow.

References

CVE-2024-56433 vulnerability report

Vulnerabilities

Dependencies

Source

Target OS

critical severity

Race Condition

Detailed paths

Overview

Remediation

References

high severity

Uncaught Exception

Detailed paths

Overview

Details

Remediation

References

high severity

Uncaught Exception

Detailed paths

Overview

Remediation

References

high severity

Uncaught Exception

Detailed paths

Overview

Remediation

References

high severity

Directory Traversal

Detailed paths

Overview

Details

Remediation

References

high severity

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Detailed paths

Overview

PoC

Remediation

References

high severity

Uncaught Exception

Detailed paths

Overview

Remediation

References

high severity

Uncaught Exception

Detailed paths

Overview

Remediation

References

high severity

UNIX Symbolic Link (Symlink) Following

Detailed paths

Overview

Remediation

References

medium severity

Directory Traversal

Detailed paths

NVD Description

Remediation

References

medium severity

Memory Leak

Detailed paths

NVD Description

Remediation

References

medium severity

Memory Leak

Detailed paths

NVD Description

Remediation

References

medium severity new

medium severity

new

medium severity

new

medium severity

new