Debian vulnerabilities
30 CVEs and advisories name Debian as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-123962In FreedomBox before 26.15, unprivileged user accounts can read/write files for which they lack permissions by setting the authorized_keys…
- CVE-2026-109518APT RCE via hard link reuse
- CVE-2026-89169live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing.
- CVE-2026-77118Out-of-bounds write in GraphicsMagick PCD decoder
- CVE-2026-11853Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution.
- CVE-2026-11852Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution.
- CVE-2026-2219It was discovered that dpkg-deb (a component of dpkg, the Debian package management system) does not properly validate the end of the data s
- CVE-2025-68462Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases.
- CVE-2025-8454It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of sc
- CVE-2025-6297dpkg-deb: Fix cleanup for control member with restricted directories
- CVE-2025-53391The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package has insecure PolicyKit allow_any/allow_inactiv
- CVE-2014-7210pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user.
- CVE-2025-47153Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.d
- CVE-2024-2312GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI system table hooks after
- CVE-2023-7207Debian's cpio contains a path traversal vulnerability.
- CVE-2022-2787stricter rules on chroot names
- CVE-2022-1664directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar
- CVE-2016-1239duck before 0.10 did not properly handle loading of untrusted code from the current directory.
- CVE-2022-0543It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape
- CVE-2021-20001It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure pe
- CVE-2020-3811qmail-verify as used in netqmail 1.06 is prone to a mail-address verification bypass vulnerability.
- CVE-2020-3812qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability.
- CVE-2020-3810Missing input validation in the ar/tar implementations of APT before version 2.1.2 could result in denial of service when processing special
- CVE-2012-1093The init script in the Debian x11-common package before 1:7.6+12 is vulnerable to a symlink attack that can lead to a privilege escalation d
- CVE-2019-3467Debian-edu-config all versions < 2.11.10, a set of configuration files used for Debian Edu, and debian-lan-config < 0.26, configured too per
- CVE-2017-5332The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local use
- CVE-2017-5331Integer overflow in the check_offset function in b/wrestool/fileread.c in icoutils before 0.31.1 allows local users to cause a denial of ser
- CVE-2017-5333Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to
- CVE-2018-5735Backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858
- CVE-2017-0359diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archive