Debian vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-2219 It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data stream when uncompresHigh 7.5 · Mar 7, 2026
• CVE-2025-8454 It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the liCritical 9.8 · Aug 1, 2025
• CVE-2025-6297 It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documenteHigh 8.2 · Jul 1, 2025
• CVE-2025-53391 The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit allow_any/allow_inactive/allow_active settiCritical 9.3 · Jun 28, 2025
• CVE-2014-7210 pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user.Critical 9.8 · Jun 26, 2025
• CVE-2024-37017 asdcplib (aka AS-DCP Lib) 2.13.1 has a heap-based buffer over-read in ASDCP::TimedText::MXFReader::h__Reader::MD_to_TimedText_TDesc in AS_DCP_TimedText.cpp in lHigh 8.1 · May 30, 2024
• CVE-2023-51714 An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2.Critical 9.8 · Dec 24, 2023
• CVE-2022-41804 Unauthorized error injection in Intel(R) SGX or Intel(R) TDX for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable escalation oHigh 7.2 · Aug 10, 2023
• CVE-2023-36053 In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial High 7.5 · Jul 3, 2023
• CVE-2023-27635 debmany in debian-goodies 0.88.1 allows attackers to execute arbitrary shell commands (because of an eval call) via a crafted .deb file.High 7.8 · Mar 5, 2023
• CVE-2020-10650 A deserialization flaw was discovered in jackson-databind through 2.9.10.4.High 8.1 · Dec 26, 2022
• CVE-2022-3109 An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null pHigh 7.5 · Dec 16, 2022
• CVE-2017-20148 In the ebuild package through logcheck-1.3.23.ebuild for Logcheck on Gentoo, it is possible to achieve root privilege escalation from the logcheck user because Critical 9.8 · Sep 20, 2022
• CVE-2022-1664 Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerabiCritical 9.8 · May 26, 2022
• CVE-2016-1239 duck before 0.10 did not properly handle loading of untrusted code from the current directory.Critical 9.8 · Feb 19, 2022
• CVE-2021-20001 It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure permissions for the usCritical 9.8 · Feb 11, 2022
• CVE-2021-38172 perM 0.4.0 has a Buffer Overflow related to strncpy.Critical 9.8 · Feb 5, 2022
• CVE-2021-31799 In RDoc 3.11 through 6.x before 6.3.1, as distributed with Ruby through 3.0.1, it is possible to execute arbitrary code via | and tags in a filename.High 7 · Jul 30, 2021
• CVE-2017-20002 The Debian shadow package before 1:4.5-1 for Shadow incorrectly lists pts/0 and pts/1 as physical terminals in /etc/securetty.High 7.8 · Mar 17, 2021
• CVE-2021-28374 The Debian courier-authlib package before 0.71.1-2 for Courier Authentication Library creates a /run/courier/authdaemon directory with weak permissions, allowinHigh 7.5 · Mar 15, 2021
• CVE-2020-36181 FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.cpdsaHigh 8.1 · Jan 6, 2021
• CVE-2020-3811 qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.High 7.5 · May 26, 2020
• CVE-2020-10969 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.High 8.8 · Mar 26, 2020
• CVE-2020-10968 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remotHigh 8.8 · Mar 26, 2020
• CVE-2020-10673 FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRHigh 8.8 · Mar 18, 2020