Vulnerabilities

 41 via 102 paths

Dependencies

 418

Source

 Group 6 Copy Created with Sketch. Docker

Target OS

 ubuntu:24.04
Test your Docker Hub image against our market leading vulnerability database Sign up for free
Severity
  • 1
  • 8
  • 17
  • 15
Status
  • 41
  • 0
  • 0
OS binaries
  • 24
  • 17

critical severity

Race Condition

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Race Condition in the vm module with the timeout option. An attacker can access secrets like tokens or passwords to leak or cause data corruption by exploiting a race condition in buffer allocation logic that allows zero-fill toggle to remain disabled when vm module timeouts interrupt execution.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Race Condition vulnerability report

high severity

Uncaught Exception

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in the SignTraits::DeriveBits() function, which incorrectly invokes ThrowException() based on user inputs when executing in a background thread. This allows an attacker to trigger a runtime crash.

Note: The cryptographic operations involved are commonly applied to untrusted input.

Details

Denial of Service (DoS) describes a family of attacks, all aimed at making a system inaccessible to its intended and legitimate users.

Unlike other vulnerabilities, DoS attacks usually do not aim at breaching security. Rather, they are focused on making websites and services unavailable to genuine users resulting in downtime.

One popular Denial of Service vulnerability is DDoS (a Distributed Denial of Service), an attack that attempts to clog network pipes to the system by generating a large volume of traffic from many machines.

When it comes to open source libraries, DoS vulnerabilities allow attackers to trigger such a crash or crippling of the service by using a flaw either in the application code or from the use of open source libraries.

Two common types of DoS vulnerabilities:

  • High CPU/Memory Consumption- An attacker sending crafted requests that could cause the system to take a disproportionate amount of time to process. For example, commons-fileupload:commons-fileupload.

  • Crash - An attacker sending crafted requests that could cause the system to crash. For Example, npm ws package

Remediation

Upgrade node to version 20.19.2, 22.15.1, 23.11.1, 24.0.2 or higher.

References

Uncaught Exception vulnerability report

high severity

Uncaught Exception

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception due to the unhandled TLSSocket error ECONNRESET. An attacker can cause application crash by passing malformed HTTP/2 HEADERS frame with oversized, invalid HPACK data.

Note:

This issue primary affects applications without explicit error handlers to secure sockets.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Uncaught Exception vulnerability report

high severity
new

Uncaught Exception

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in Node.js HTTP request handling. The flaw triggers when an incoming request includes a header named __proto__ and the server application accesses req.headersDistinct. This causes dest["__proto__"] to incorrectly resolve to Object.prototype, resulting in an uncaught TypeError when .push() is called on a non-array. Because this exception is thrown synchronously inside a property getter, standard error listeners cannot intercept it. This causes the Node.js process to crash unless every access is explicitly wrapped in a try/catch block.

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

Uncaught Exception vulnerability report

high severity

Directory Traversal

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Directory Traversal in the path.join function. An attacker can bypass the path traversal protection and access restricted files by crafting specific path inputs that leverage Windows reserved driver names such as CON, PRN, and AUX.

Note: This issue only affects Windows systems and is a result of an incomplete fix for CVE-2025-23084

Details

A Directory Traversal attack (also known as path traversal) aims to access files and directories that are stored outside the intended folder. By manipulating files with "dot-dot-slash (../)" sequences and its variations, or by using absolute file paths, it may be possible to access arbitrary files and directories stored on file system, including application source code, configuration, and other critical system files.

Directory Traversal vulnerabilities can be generally divided into two types:

  • Information Disclosure: Allows the attacker to gain information about the folder structure or read the contents of sensitive files on the system.

st is a module for serving static files on web pages, and contains a vulnerability of this type. In our example, we will serve files from the public route.

If an attacker requests the following URL from our server, it will in turn leak the sensitive private key of the root user.

curl http://localhost:8080/public/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/root/.ssh/id_rsa

Note %2e is the URL encoded version of . (dot).

  • Writing arbitrary files: Allows the attacker to create or replace existing files. This type of vulnerability is also known as Zip-Slip.

One way to achieve this is by using a malicious zip archive that holds path traversal filenames. When each filename in the zip archive gets concatenated to the target extraction folder, without validation, the final path ends up outside of the target folder. If an executable or a configuration file is overwritten with a file containing malicious code, the problem can turn into an arbitrary code execution issue quite easily.

The following is an example of a zip archive with one benign file and one malicious file. Extracting the malicious file will result in traversing out of the target folder, ending up in /root/.ssh/ overwriting the authorized_keys file:

2018-04-15 22:04:29 .....           19           19  good.txt
2018-04-15 22:04:42 .....           20           20  ../../../../../../root/.ssh/authorized_keys

Remediation

Upgrade node to version 20.19.4, 22.17.1, 24.4.1 or higher.

References

Directory Traversal vulnerability report

high severity

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

  • Vulnerable module: node
  • Introduced through: node@20.17.0
  • Fixed in: 20.20.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Reliance on Undefined, Unspecified, or Implementation-Defined Behavior due to a flaw in error handling when async_hooks (or AsyncLocalStorage) is enabled. Normally, a "Maximum call stack size exceeded" error (stack overflow) is catchable by try-catch blocks or uncaughtException handlers. However, if this error occurs while an async_hooks callback is on the stack (which happens frequently in frameworks like Next.js or when using APM tools), Node.js treats it as a fatal error. Remote attackers can trigger this crash by sending payloads that cause deep recursion (e.g., deeply nested JSON objects), leading to a Denial of Service.

Notes:

  1. Node.js 24.x and 25.x are less affected if using only AsyncLocalStorage, as they use a newer V8 feature that avoids this hook mechanism;

  2. The patch improves recoverability in one edge case, but it does not remove the broader risk. Recovery from space exhaustion is unspecified, best‑effort behavior and is not a reliable basis for availability or security.

PoC

import { createHook } from 'node:async_hooks';

// This simulates what APM tools do
createHook({ init() {} }).enable();

function recursive() {
  new Promise(() => {}); // Creates async context
  return recursive();
}

try {
  recursive();
} catch (err) {
  console.log('This never runs', err);
}

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior vulnerability report

high severity

Uncaught Exception

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in the TLS module when a TLS server is configured with pskCallback or ALPNCallback. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Uncaught Exception vulnerability report

high severity
new

Uncaught Exception

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Uncaught Exception in the TLS module when a SNICallback throws synchronously on unexpected input the exception bypasses TLS error handlers and propagates as an uncaught exception. A remote attacker can crash or exhaust resources of a TLS server by sending input that causes the callback to throw an error.

Note:

This is caused by an incomplete fix for CVE-2026-21637.

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

Uncaught Exception vulnerability report

high severity

UNIX Symbolic Link (Symlink) Following

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to UNIX Symbolic Link (Symlink) Following in the fs.symlink() function. An attacker can escape the allowed path and read/write sensitive files by chaining directories and symlinks, bypassing --allow-fs-read and --allow-fs-write restrictions.

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

UNIX Symbolic Link (Symlink) Following vulnerability report

medium severity

Directory Traversal

  • Vulnerable module: pam/libpam-modules
  • Introduced through: pam/libpam-modules@1.5.3-5ubuntu5.5, pam/libpam-modules-bin@1.5.3-5ubuntu5.5 and others

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › pam/libpam-modules@1.5.3-5ubuntu5.5
  • Introduced through: rocker/shiny-verse@latest › pam/libpam-modules-bin@1.5.3-5ubuntu5.5
  • Introduced through: rocker/shiny-verse@latest › pam/libpam-runtime@1.5.3-5ubuntu5.5
  • Introduced through: rocker/shiny-verse@latest › pam/libpam0g@1.5.3-5ubuntu5.5

NVD Description

Note: Versions mentioned in the description apply only to the upstream pam package and not the pam package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.

Remediation

There is no fixed version for Ubuntu:24.04 pam.

References

Directory Traversal vulnerability report

medium severity

Memory Leak

  • Vulnerable module: freeglut/libglut3.12
  • Introduced through: freeglut/libglut3.12@3.4.0-1build1
  • Fixed in: 3.4.0-1ubuntu0.1~esm1

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › freeglut/libglut3.12@3.4.0-1build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream freeglut package and not the freeglut package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry function.

Remediation

Upgrade Ubuntu:24.04 freeglut to version 3.4.0-1ubuntu0.1~esm1 or higher.

References

Memory Leak vulnerability report

medium severity

Memory Leak

  • Vulnerable module: freeglut/libglut3.12
  • Introduced through: freeglut/libglut3.12@3.4.0-1build1
  • Fixed in: 3.4.0-1ubuntu0.1~esm1

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › freeglut/libglut3.12@3.4.0-1build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream freeglut package and not the freeglut package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function.

Remediation

Upgrade Ubuntu:24.04 freeglut to version 3.4.0-1ubuntu0.1~esm1 or higher.

References

Memory Leak vulnerability report

medium severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the ReadFileUtf8 internal binding, which fails to clean up pointers in uv_fs_s.file. UTF-16 path buffers leak memory, which can lead to denial of service.

Note:

CVE-2025-23122 is a duplicate of this vulnerability.

Remediation

Upgrade node to version 20.19.2, 22.15.1 or higher.

References

Allocation of Resources Without Limits or Throttling vulnerability report

medium severity

HTTP Request Smuggling

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling in the llhttp implementation, when handing HTTP/1 headers terminated with \r\n\rX instead of the required \r\n\r\n. This allows attackers to bypass proxy-based access controls and submit unauthorized requests.

Remediation

Upgrade node to version 20.19.2 or higher.

References

HTTP Request Smuggling vulnerability report

medium severity
new

Inefficient Algorithmic Complexity

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the V8 JavaScript engine due to the string hashing mechanism predictably hashing integer-like strings directly to their numeric values. An attacker can exploit this by sending maliciously crafted payloads containing many colliding strings to endpoints that process user input (most commonly via JSON.parse()). This causes massive hash collisions within V8's internal string table, drastically degrading the performance of the Node.js process and resulting in a Denial of Service (DoS).

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

Inefficient Algorithmic Complexity vulnerability report

medium severity
new

Missing Release of Memory after Effective Lifetime

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in HTTP/2 servers that triggers when a client sends WINDOW_UPDATE frames on stream 0 that cause the flow control window to exceed $2^{31}-1$. Although the server responds with a GOAWAY frame, it fails to properly clean up the Http2Session object. An unauthenticated remote attacker can exploit this by continuously opening connections and sending these crafted frames. This forces the server to leak memory indefinitely, eventually causing resource exhaustion and a Denial of Service (DoS).

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

Missing Release of Memory after Effective Lifetime vulnerability report

medium severity

Divide By Zero

  • Vulnerable module: pixman/libpixman-1-0
  • Introduced through: pixman/libpixman-1-0@0.42.2-1build1 and pixman/libpixman-1-dev@0.42.2-1build1

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › pixman/libpixman-1-0@0.42.2-1build1
  • Introduced through: rocker/shiny-verse@latest › pixman/libpixman-1-dev@0.42.2-1build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream pixman package and not the pixman package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

stress-test master commit e4c878 was discovered to contain a FPE vulnerability via the component combine_inner at /pixman-combine-float.c.

Remediation

There is no fixed version for Ubuntu:24.04 pixman.

References

Divide By Zero vulnerability report

medium severity
new

Observable Timing Discrepancy

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Observable Timing Discrepancy due to the crypto_hmac.cc module using memcmp(), a non-constant-time comparison function to validate user-provided HMAC signatures, rather than the timing-safe equivalents used elsewhere in the codebase. An attacker capable of taking high-resolution timing measurements can use the application as a timing oracle. Because the comparison leaks timing information proportional to the number of matching bytes, the attacker can iteratively infer the expected HMAC values, ultimately enabling them to forge valid Message Authentication Codes (MACs).

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

Observable Timing Discrepancy vulnerability report

medium severity

Open Redirect

  • Vulnerable module: wget
  • Introduced through: wget@1.21.4-1ubuntu4.1

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › wget@1.21.4-1ubuntu4.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream wget package and not the wget package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Remediation

There is no fixed version for Ubuntu:24.04 wget.

References

Open Redirect vulnerability report

medium severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A vulnerability was determined in GNU Binutils 2.45. The affected element is the function elf_x86_64_relocate_section of the file elf64-x86-64.c of the component Linker. This manipulation causes heap-based buffer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 6b21c8b2ecfef5c95142cbc2c32f185cb1c26ab0. To fix this issue, it is recommended to deploy a patch.

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

Out-of-Bounds vulnerability report

medium severity

Algorithmic Complexity

  • Vulnerable module: expat/libexpat1
  • Introduced through: expat/libexpat1@2.6.1-2ubuntu0.4 and expat/libexpat1-dev@2.6.1-2ubuntu0.4

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › expat/libexpat1@2.6.1-2ubuntu0.4
  • Introduced through: rocker/shiny-verse@latest › expat/libexpat1-dev@2.6.1-2ubuntu0.4

NVD Description

Note: Versions mentioned in the description apply only to the upstream expat package and not the expat package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time.

Remediation

There is no fixed version for Ubuntu:24.04 expat.

References

Algorithmic Complexity vulnerability report

medium severity

Incorrect Authorization

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Incorrect Authorization in the permission model via the fs.futimes() function due to failing to check for write permissions. A process restricted to "read-only" access can still modify a file's access and modification timestamps. While it doesn't allow changing the file's content, it can be used to obscure malicious activity by tampering with audit logs or metadata.

Note:

This is only exploitable if the attacker already has the ability to execute code on the system (within the restricted Node.js environment).

Remediation

Upgrade node to version 20.20.0, 22.22.0, 24.13.0, 25.3.0 or higher.

References

Incorrect Authorization vulnerability report

medium severity
new

Missing Authorization

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Missing Authorization via the fs.realpathSync.native() function. An attacker running malicious code within a restricted Node.js environment (where --allow-fs-read is intentionally limited) can exploit this missing check to verify file existence, resolve symlink targets, and enumerate paths outside of the permitted directories, leading to unauthorized information disclosure.

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

Missing Authorization vulnerability report

medium severity

Improper Verification of Cryptographic Signature

  • Vulnerable module: gnupg2/dirmngr
  • Introduced through: gnupg2/dirmngr@2.4.4-2ubuntu17.4, gnupg2/gpg-agent@2.4.4-2ubuntu17.4 and others

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › gnupg2/dirmngr@2.4.4-2ubuntu17.4
  • Introduced through: rocker/shiny-verse@latest › gnupg2/gpg-agent@2.4.4-2ubuntu17.4
  • Introduced through: rocker/shiny-verse@latest › gnupg2/gpgv@2.4.4-2ubuntu17.4
  • Introduced through: rocker/shiny-verse@latest › gnupg2/keyboxd@2.4.4-2ubuntu17.4

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

In GnuPG through 2.4.8, if a signed message has \f at the end of a plaintext line, an adversary can construct a modified message that places additional text after the signed material, such that signature verification of the modified message succeeds (although an "invalid armor" message is printed during verification). This is related to use of \f as a marker to denote truncation of a long plaintext line.

Remediation

There is no fixed version for Ubuntu:24.04 gnupg2.

References

Improper Verification of Cryptographic Signature vulnerability report

medium severity

Out-of-Bounds

  • Vulnerable module: binutils
  • Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component ld. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

Out-of-Bounds vulnerability report

medium severity

Directory Traversal

  • Vulnerable module: tar
  • Introduced through: tar@1.35+dfsg-3build1

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › tar@1.35+dfsg-3build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream tar package and not the tar package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each "tar xf" in its Security Rules of Thumb; however, third-party advice leads users to run "tar xf" more than once into the same directory.

Remediation

There is no fixed version for Ubuntu:24.04 tar.

References

Directory Traversal vulnerability report

low severity

Out-of-Bounds

  • Vulnerable module: elfutils/libelf1t64
  • Introduced through: elfutils/libelf1t64@0.190-1.1ubuntu0.1

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › elfutils/libelf1t64@0.190-1.1ubuntu0.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils package and not the elfutils package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue.

Remediation

There is no fixed version for Ubuntu:24.04 elfutils.

References

Out-of-Bounds vulnerability report

low severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: glibc/libc-bin
  • Introduced through: glibc/libc-bin@2.39-0ubuntu8.7, glibc/libc-dev-bin@2.39-0ubuntu8.7 and others

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › glibc/libc-bin@2.39-0ubuntu8.7
  • Introduced through: rocker/shiny-verse@latest › glibc/libc-dev-bin@2.39-0ubuntu8.7
  • Introduced through: rocker/shiny-verse@latest › glibc/libc6@2.39-0ubuntu8.7
  • Introduced through: rocker/shiny-verse@latest › glibc/libc6-dev@2.39-0ubuntu8.7
  • Introduced through: rocker/shiny-verse@latest › glibc/locales@2.39-0ubuntu8.7

NVD Description

Note: Versions mentioned in the description apply only to the upstream glibc package and not the glibc package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.

Remediation

There is no fixed version for Ubuntu:24.04 glibc.

References

Allocation of Resources Without Limits or Throttling vulnerability report

low severity

Buffer Overflow

  • Vulnerable module: icu/icu-devtools
  • Introduced through: icu/icu-devtools@74.2-1ubuntu3.1, icu/libicu-dev@74.2-1ubuntu3.1 and others

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › icu/icu-devtools@74.2-1ubuntu3.1
  • Introduced through: rocker/shiny-verse@latest › icu/libicu-dev@74.2-1ubuntu3.1
  • Introduced through: rocker/shiny-verse@latest › icu/libicu74@74.2-1ubuntu3.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream icu package and not the icu package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

Remediation

There is no fixed version for Ubuntu:24.04 icu.

References

Buffer Overflow vulnerability report

low severity

Out-of-bounds Write

  • Vulnerable module: cairo/libcairo-gobject2
  • Introduced through: cairo/libcairo-gobject2@1.18.0-3build1, cairo/libcairo-script-interpreter2@1.18.0-3build1 and others

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › cairo/libcairo-gobject2@1.18.0-3build1
  • Introduced through: rocker/shiny-verse@latest › cairo/libcairo-script-interpreter2@1.18.0-3build1
  • Introduced through: rocker/shiny-verse@latest › cairo/libcairo2@1.18.0-3build1
  • Introduced through: rocker/shiny-verse@latest › cairo/libcairo2-dev@1.18.0-3build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream cairo package and not the cairo package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

cairo through 1.15.14 has an out-of-bounds stack-memory write during processing of a crafted document by WebKitGTK+ because of the interaction between cairo-rectangular-scan-converter.c (the generate and render_rows functions) and cairo-image-compositor.c (the _cairo_image_spans_and_zero function).

Remediation

There is no fixed version for Ubuntu:24.04 cairo.

References

Out-of-bounds Write vulnerability report

low severity

Reachable Assertion

  • Vulnerable module: cairo/libcairo-gobject2
  • Introduced through: cairo/libcairo-gobject2@1.18.0-3build1, cairo/libcairo-script-interpreter2@1.18.0-3build1 and others

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › cairo/libcairo-gobject2@1.18.0-3build1
  • Introduced through: rocker/shiny-verse@latest › cairo/libcairo-script-interpreter2@1.18.0-3build1
  • Introduced through: rocker/shiny-verse@latest › cairo/libcairo2@1.18.0-3build1
  • Introduced through: rocker/shiny-verse@latest › cairo/libcairo2-dev@1.18.0-3build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream cairo package and not the cairo package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

An issue was discovered in cairo 1.16.0. There is an assertion problem in the function _cairo_arc_in_direction in the file cairo-arc.c.

Remediation

There is no fixed version for Ubuntu:24.04 cairo.

References

Reachable Assertion vulnerability report

low severity

Improper Input Validation

  • Vulnerable module: coreutils
  • Introduced through: coreutils@9.4-3ubuntu6.1

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › coreutils@9.4-3ubuntu6.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream coreutils package and not the coreutils package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.

Remediation

There is no fixed version for Ubuntu:24.04 coreutils.

References

Improper Input Validation vulnerability report

low severity

Allocation of Resources Without Limits or Throttling

  • Vulnerable module: binutils
  • Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

Allocation of Resources Without Limits or Throttling vulnerability report

low severity

NULL Pointer Dereference

  • Vulnerable module: cairo/libcairo-gobject2
  • Introduced through: cairo/libcairo-gobject2@1.18.0-3build1, cairo/libcairo-script-interpreter2@1.18.0-3build1 and others

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › cairo/libcairo-gobject2@1.18.0-3build1
  • Introduced through: rocker/shiny-verse@latest › cairo/libcairo-script-interpreter2@1.18.0-3build1
  • Introduced through: rocker/shiny-verse@latest › cairo/libcairo2@1.18.0-3build1
  • Introduced through: rocker/shiny-verse@latest › cairo/libcairo2-dev@1.18.0-3build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream cairo package and not the cairo package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

Cairo version 1.15.4 is vulnerable to a NULL pointer dereference related to the FT_Load_Glyph and FT_Render_Glyph resulting in an application crash.

Remediation

There is no fixed version for Ubuntu:24.04 cairo.

References

NULL Pointer Dereference vulnerability report

low severity

Improper Resource Shutdown or Release

  • Vulnerable module: elfutils/libelf1t64
  • Introduced through: elfutils/libelf1t64@0.190-1.1ubuntu0.1

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › elfutils/libelf1t64@0.190-1.1ubuntu0.1

NVD Description

Note: Versions mentioned in the description apply only to the upstream elfutils package and not the elfutils package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue.

Remediation

There is no fixed version for Ubuntu:24.04 elfutils.

References

Improper Resource Shutdown or Release vulnerability report

low severity

Memory Leak

  • Vulnerable module: binutils
  • Introduced through: binutils@2.42-4ubuntu2.10, binutils/binutils-common@2.42-4ubuntu2.10 and others

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › binutils@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/binutils-common@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/binutils-x86-64-linux-gnu@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libbinutils@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libctf-nobfd0@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libctf0@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libgprofng0@2.42-4ubuntu2.10
  • Introduced through: rocker/shiny-verse@latest › binutils/libsframe1@2.42-4ubuntu2.10

NVD Description

Note: Versions mentioned in the description apply only to the upstream binutils package and not the binutils package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."

Remediation

There is no fixed version for Ubuntu:24.04 binutils.

References

Memory Leak vulnerability report

low severity

Out-of-bounds Write

  • Vulnerable module: gnupg2/dirmngr
  • Introduced through: gnupg2/dirmngr@2.4.4-2ubuntu17.4, gnupg2/gpg-agent@2.4.4-2ubuntu17.4 and others

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › gnupg2/dirmngr@2.4.4-2ubuntu17.4
  • Introduced through: rocker/shiny-verse@latest › gnupg2/gpg-agent@2.4.4-2ubuntu17.4
  • Introduced through: rocker/shiny-verse@latest › gnupg2/gpgv@2.4.4-2ubuntu17.4
  • Introduced through: rocker/shiny-verse@latest › gnupg2/keyboxd@2.4.4-2ubuntu17.4

NVD Description

Note: Versions mentioned in the description apply only to the upstream gnupg2 package and not the gnupg2 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB.

Remediation

There is no fixed version for Ubuntu:24.04 gnupg2.

References

Out-of-bounds Write vulnerability report

low severity
new

Missing Authorization

  • Vulnerable module: node
  • Introduced through: node@20.17.0

Detailed paths

  • Introduced through: docker-image|rocker/shiny-verse@latest › node@20.17.0

Overview

node is a JavaScript runtime built on Chrome's V8 JavaScript engine.

Affected versions of this package are vulnerable to Missing Authorization via FileHandle.chmod or FileHandle.chown functions which can use a "read-only" file descriptor to change the owner and permissions of a file.

Notes:

  • This is only exploitable for users using the experimental permission when the --allow-fs-write flag is used;

  • This is caused by an incomplete fix for CVE-2024-36137.

Remediation

Upgrade node to version 20.20.2, 22.22.2, 24.14.1, 25.8.2 or higher.

References

Missing Authorization vulnerability report

low severity

NULL Pointer Dereference

  • Vulnerable module: harfbuzz/gir1.2-harfbuzz-0.0
  • Introduced through: harfbuzz/gir1.2-harfbuzz-0.0@8.3.0-2build2, harfbuzz/libharfbuzz-cairo0@8.3.0-2build2 and others

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › harfbuzz/gir1.2-harfbuzz-0.0@8.3.0-2build2
  • Introduced through: rocker/shiny-verse@latest › harfbuzz/libharfbuzz-cairo0@8.3.0-2build2
  • Introduced through: rocker/shiny-verse@latest › harfbuzz/libharfbuzz-dev@8.3.0-2build2
  • Introduced through: rocker/shiny-verse@latest › harfbuzz/libharfbuzz-gobject0@8.3.0-2build2
  • Introduced through: rocker/shiny-verse@latest › harfbuzz/libharfbuzz-icu0@8.3.0-2build2
  • Introduced through: rocker/shiny-verse@latest › harfbuzz/libharfbuzz-subset0@8.3.0-2build2
  • Introduced through: rocker/shiny-verse@latest › harfbuzz/libharfbuzz0b@8.3.0-2build2

NVD Description

Note: Versions mentioned in the description apply only to the upstream harfbuzz package and not the harfbuzz package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

HarfBuzz is a text shaping engine. Prior to version 12.3.0, a null pointer dereference vulnerability exists in the SubtableUnicodesCache::create function located in src/hb-ot-cmap-table.hh. The function fails to check if hb_malloc returns NULL before using placement new to construct an object at the returned pointer address. When hb_malloc fails to allocate memory (which can occur in low-memory conditions or when using custom allocators that simulate allocation failures), it returns NULL. The code then attempts to call the constructor on this null pointer using placement new syntax, resulting in undefined behavior and a Segmentation Fault. This issue has been patched in version 12.3.0.

Remediation

There is no fixed version for Ubuntu:24.04 harfbuzz.

References

NULL Pointer Dereference vulnerability report

low severity

Covert Timing Channel

  • Vulnerable module: libgcrypt20
  • Introduced through: libgcrypt20@1.10.3-2build1

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › libgcrypt20@1.10.3-2build1

NVD Description

Note: Versions mentioned in the description apply only to the upstream libgcrypt20 package and not the libgcrypt20 package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

Remediation

There is no fixed version for Ubuntu:24.04 libgcrypt20.

References

Covert Timing Channel vulnerability report

low severity

CVE-2024-56433

  • Vulnerable module: shadow/login
  • Introduced through: shadow/login@1:4.13+dfsg1-4ubuntu3.2 and shadow/passwd@1:4.13+dfsg1-4ubuntu3.2

Detailed paths

  • Introduced through: rocker/shiny-verse@latest › shadow/login@1:4.13+dfsg1-4ubuntu3.2
  • Introduced through: rocker/shiny-verse@latest › shadow/passwd@1:4.13+dfsg1-4ubuntu3.2

NVD Description

Note: Versions mentioned in the description apply only to the upstream shadow package and not the shadow package as distributed by Ubuntu. See How to fix? for Ubuntu:24.04 relevant fixed versions and status.

shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid.

Remediation

There is no fixed version for Ubuntu:24.04 shadow.

References

CVE-2024-56433 vulnerability report