BlackTreeLifecycle intelligence
Evidence-linked product lifecycle intelligenceSUPPORT · SECURITY · RETIREMENT

VERIFIED PUBLISHER INTELLIGENCE

Release notes and known issues

Source-attributed product updates, affected versions, fixes and operational context. Update publication dates are kept separate from lifecycle boundaries.

85 official publisher sources registered · 83 collected automatically · 0 monitored for availability · 2 requires publisher access

7728 verified publisher records · Page 1 of 78

DEBIANDSA-6590-1

DSA-6590-1 firefox-esr - security update

Multiple security issues have been found in the Mozilla Firefox web browser, which could potentially result in the execution of arbitrary code, sandbox escape, bypass of the same-origin policy, privilege escalation, information disclosure or spoofing. https://security-tracker.debian.org/tracker/DSA-6590-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6591-1

DSA-6591-1 openjdk-25 - security update

Several vulnerabilities have been discovered in the OpenJDK Java runtime, which may result in denial of service, sandbox breakout, incomplete certificate checks or information disclosure. https://security-tracker.debian.org/tracker/DSA-6591-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6593-1

DSA-6593-1 imagemagick - security update

Multiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, information disclosure or potentially arbitrary code execution if malformed images are processed. https://security-tracker.debian.org/tracker/DSA-6593-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6594-1

DSA-6594-1 python-git - security update

Multiple security issues were discovered in GitPython, a Python library to interact with Git repositories, which could result in information disclosure, directory traversal, execution of arbitrary code or denial of service. https://security-tracker.debian.org/tracker/DSA-6594-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6595-1

DSA-6595-1 tor - security update

Multiple security vulnerabilities were discovered in Tor, a connection- based low-latency anonymous communication system, would could result in denial of service. https://security-tracker.debian.org/tracker/DSA-6595-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6596-1

DSA-6596-1 wordpress - security update

Several vulnerabilities were discovered in wordpress, a web blogging tool, which could result in denial of service, cross-site scripting, SQL injection, information disclosure, privilege escalation or remote code execution. https://security-tracker.debian.org/tracker/DSA-6596-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6597-1

DSA-6597-1 dpdk - security update

Several vulnerabilities were discovered in DPDK, a set of libraries for fast packet processing. Depending on enabled functionality, crafted packets or malicious guest requests could cause denial of service or memory corruption. https://security-tracker.debian.org/tracker/DSA-6597-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6599-1

DSA-6599-1 nss - security update

It was discovered that several eMudhra intermediate CA certificates have been compromised. Updated nss packages are provided to remove the "eMudhra emSign Root CA - G3", "eMudhra emSign Root CA - C1" and "emSign ECC Root CA - C3" certificates. https://security-tracker.debian.org/tracker/DSA-6599-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6600-1

DSA-6600-1 vim - security update

Multiple vulnerabilities were found and fixed in Vim, an enhanced version of the standard UNIX editor Vi (Vi IMproved). A remote attacker could trigger arbitrary code execution, command injection, or a crash (potential memory-corruption) via crafted files, archives, help/tag files, modelines, spell files, or crafted input to the NetBeans interface. CVE-2025-53905 - Path traversal in the tar plugin. The tar plugin did not protect archive member names against ".." traversal. CVE-2025-53906 - Path traversal in the zip plugin. The zip plugin did not protect archive member names against ".." traversal. CVE-2026-25749 - Buffer overflow in 'helpfile' option handling. Overlong help file paths could overflow a fixed-size buffer. CVE-2026-26269 - Buffer overflow in the NetBeans interface. Specially crafted NetBeans protocol input could overflow a buffer. CVE-2026-28417 - Command injection using netrw. Crafted file names could break out of netrw commands. CVE-2026-28418 - Crash with an overlong emacs tag file. An overlong tag line could crash the tag reader. CVE-2026-28419 - Buffer underflow with an emacs tag file. Crafted emacs tag files could cause an underflow. CVE-2026-28420 - Buffer overflow in terminal handling. Combining characters could overflow the terminal buffer. CVE-2026-28421 - Crash when recovering a corrupted swap file. Malformed swap files could crash vim during recovery. CVE-2026-28422 - Stack buffer overflow in build_stl_str_hl(). Multibyte fill characters could overflow the statusline buffer. CVE-2026-32249 - Crash with a composing char in a regexp range. A composing character ending a character range could corrupt the NFA regex compiler. CVE-2026-33412 - Command injection via newline in glob(). A newline in a glob pattern could inject shell commands. CVE-2026-34982 - Modeline security bypass. Modeline processing could be abused despite restrictions. CVE-2026-35177 - Path traversal in the zip plugin. Archive entries with ".." could escape the target directory. CVE-2026-39881 - Command injection in the NetBeans interface. defineAnnoType or special keys could inject Ex commands. CVE-2026-41411 - Command injection via backticks in tag files. Backticks in tag files could trigger shell execution. CVE-2026-42307 - netrw shell injection via sftp: and file: URLs. Malicious URLs could inject shell commands. CVE-2026-43961 - netrw code injection via the mf command. The mf command could run injected Vim script. CVE-2026-44656 - Backticks in 'path' cause shell execution on completion. Completion searched backtick expressions in 'path'. CVE-2026-45130 - Heap buffer overflow in spellfile.c read_compound(). A crafted spell file could overflow a heap buffer. CVE-2026-46483 - Command injection in the tar plugin. Archive filenames could inject shell commands. CVE-2026-47162 - netrw code injection via NetrwBookHistSave(). Bookmark/history data could inject Vim commands. CVE-2026-47167 - Code injection in the cucumber filetype plugin. Crafted Cucumber features could run Vim commands. CVE-2026-52858 - Code execution with python3complete. Completion could execute unsafe Python imports. CVE-2026-52859 - Out-of-bounds read in update_snapshot(). Terminal snapshots could cause an out-of-bounds read. CVE-2026-52860 - Code execution with python complete. Completion could execute unsafe Python code. CVE-2026-55693 - Out-of-bounds write in tree_count_words(). A crafted spell file could cause an out-of-bounds write. CVE-2026-55892 - Stack out-of-bounds write in dump_prefixes(). A crafted spell file could overflow the stack. CVE-2026-55895 - netrw code injection in local file deletion. Local file deletion could run injected commands. CVE-2026-57452 - Out-of-bounds read with sodium-encrypted files. Malformed encrypted files could cause an out-of-bounds read. CVE-2026-57455 - Out-of-bounds write with soundfold(). Crafted spell data could overflow when using soundfold(). CVE-2026-57456 - Code execution with python complete. Completion could execute unsa

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6600-2

DSA-6600-2 vim - regression update

The update for vim in DSA 6600-1 did not correctly built binary packages for the s390x architecture due to test failures during during build. This update corrects that problem. https://security-tracker.debian.org/tracker/DSA-6600-2

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6601-1

DSA-6601-1 eog - security update

A buffer overflow was found in the "Eye of GNOME" graphics viewer program, which could possibly result in the execution of arbitrary code when opening a malformed PNG file. https://security-tracker.debian.org/tracker/DSA-6601-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6603-1

DSA-6603-1 git-annex - security update

A vulnerabilitiy was discovered in git-annex, a tool to manage large files with git, without storing the file contents in git, which could result in data exfiltration. For additional details please refer to the upstream advisory at https://git-annex.branchable.com/security/cross_repository_data_exfiltration_via_special_remote/ https://security-tracker.debian.org/tracker/DSA-6603-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6604-1

DSA-6604-1 incus - security update

Multiple security issues were discovered in Incus, a system container and virtual machine manager, which could result in a bypass of security/authorisation restrictions, denial of service. privilege escalation or information disclosure. https://security-tracker.debian.org/tracker/DSA-6604-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6606-1

DSA-6606-1 squid - security update

Several security issues were found in Squid, a caching proxy for the web. These issues could allow request smuggling, buffer overflows or FTP command injection under certain conditions. https://security-tracker.debian.org/tracker/DSA-6606-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6607-1

DSA-6607-1 apt - security update

Max Justicz discovered a vulnerability in the APT package manager. APT can merge two different package downloads after an HTTP redirect gives them the same URI. Improper file handling when resuming an HTTP download allows a man-in-the-middle attacker to replace a package after verification, resulting in the execution of arbitrary code as root. https://security-tracker.debian.org/tracker/DSA-6607-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6610-1

DSA-6610-1 xen - security update

Multiple vulnerabilities have been discovered in the Xen hypervisor, which could result in guest-to-host privilege escalation or information disclosure. https://security-tracker.debian.org/tracker/DSA-6610-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6611-1

DSA-6611-1 imagemagick - security update

Multiple security vulnerabilities were discovered in imagemagick, a software suite used for editing and manipulating digital images, which could lead to denial of service, bypass of policy restrictions, information disclosure or potentially arbitrary code execution if malformed images are processed. https://security-tracker.debian.org/tracker/DSA-6611-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6613-1

DSA-6613-1 zlib - security update

Several vulnerabilities were discovered in the zlib compression library, which could result in denial of service or potentially the execution of arbitrary code if specially crafted input is processed. https://security-tracker.debian.org/tracker/DSA-6613-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6614-1

DSA-6614-1 ruby3.3 - security update

Several vulnerabilities have been discovered in the interpreter for the Ruby language, which may result in IMAP command injection, denial of service, information disclosure or the execution of arbitrary code. https://security-tracker.debian.org/tracker/DSA-6614-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →
DEBIANDSA-6617-1

DSA-6617-1 symfony - security update

Multiple vulnerabilities have been found in the Symfony PHP framework which could lead to a bypass of access restrictions, information disclosure, XML external entity injection or denial of service. https://security-tracker.debian.org/tracker/DSA-6617-1

Published Never · Source checked 11 Nov 2026

Release notes and known issues →