These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
The Debian live-boot package is vulnerable to a bypass of the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing. This vulnerability affects Debian live-boot users and administrators, who should assess their exposure and verify the integrity of the .verity file in their installations. They should also apply patches or updates provided by Debian to fix the vulnerabil [truncated]
CVE-2026-11853 is a vulnerability in Debusine, an integrated solution for building, distributing, and maintaining Debian-based distributions. The vulnerability allows for the creation of arbitrary symbolic links on a worker, potentially overwriting any file accessible to the worker user. This issue arises from the parser used to read Debian source packages (.dsc) and upload artifacts (.changes) accepting [truncated]
A medium-severity vulnerability was found in Debusine, an integrated solution for building, distributing, and maintaining Debian-based systems. The issue arises from the lack of proper permission checks in endpoints that manage relationships between artifacts. Specifically, the endpoints responsible for creating and deleting relationships between artifacts only require the ability to see the artifacts in [truncated]
CVE-2024-28085 is a low-severity local issue in util-linux wall where escape sequences passed via argv are not blocked, even though escape sequences from stdin are filtered. In environments where wall is installed with setgid tty permissions, that gap can allow terminal manipulation of other users’ sessions. The public record notes plausible scenarios that could contribute to account compromise, but the d [truncated]
CVE-2023-51385 is an OpenSSH client-side command injection issue published on 2023-12-18 and later updated in NVD on 2026-05-12. The problem affects OpenSSH versions before 9.6 when a user name or host name containing shell metacharacters is referenced through an expansion token in certain situations. The public example in the NVD description is an untrusted Git repository with a submodule that embeds a d [truncated]
CVE-2023-51384 is a medium-severity OpenSSH ssh-agent issue published on 2023-12-18. When destination constraints are added for PKCS#11-hosted private keys, ssh-agent may apply those constraints only to the first key returned by a token. That means later keys from the same token may not receive the intended destination restriction, reducing the protection those constraints are supposed to provide.
CVE-2019-11840 affects the amd64 implementation of golang.org/x/crypto's salsa20 code. After very large keystream generation, the implementation can begin producing incorrect output and then cycle back to previously generated keystream, which can undermine confidentiality in encryption use cases and predictability in CSPRNG use cases. The issue was publicly disclosed in 2019 and is fixed in the upstream c [truncated]
CVE-2016-5315 is a memory-safety issue in libtiff's setByteArray function that can trigger an out-of-bounds read when a crafted TIFF image is processed, resulting in denial of service. NVD assigns it CVSS 3.0 5.5 MEDIUM (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) and maps it to CWE-125.
CVE-2016-10244 is a FreeType font-parsing vulnerability in parse_charstrings that can read past heap memory when processing a crafted font missing a glyph name. NVD rates the issue HIGH and lists impact on confidentiality, integrity, and availability, although the CVSS vector also indicates user interaction is required. Systems that ingest untrusted fonts or ship bundled FreeType builds should prioritize patching.
CVE-2017-6500 affects ImageMagick 6.9.7 and is described as a heap-based buffer over-read triggered by a specially crafted sun file. NVD rates it Medium (CVSS 5.5) with local attack requirements and user interaction needed, and the primary impact is availability. If your environment processes untrusted image uploads or includes the affected ImageMagick build, this is worth patching and validating through [truncated]
CVE-2017-6499 is a denial-of-service issue in Magick++ for ImageMagick 6.9.7. According to NVD, a specially crafted file can create a nested exception that leads to a memory leak, which can exhaust resources and disrupt service availability. NVD rates the issue as CVSS 3.0 5.5 (Medium) with availability impact high. Debian references the issue in DSA-3808, and the ImageMagick project published a patch com [truncated]
CVE-2017-6498 is a denial-of-service issue in ImageMagick 6.9.7 affecting TGA file handling. According to the CVE and NVD record, incorrectly formed TGA files can trigger assertion failures during image processing, causing the application to stop or become unavailable. NVD classifies the issue as medium severity and notes a local, user-interaction-dependent attack path.
CVE-2017-5356 affects Irssi before 0.8.21. A remote attacker can trigger a denial of service by sending a string that includes the formatting sequence "%[" without a closing "]", which leads to an out-of-bounds read and a crash. The NVD CVSS vector rates the issue as high severity because it is network-reachable, requires no privileges or user interaction, and fully impacts availability.
CVE-2017-5194 is a high-severity use-after-free in Irssi before 0.8.21. According to the NVD record, a remote attacker can trigger a denial of service by sending an invalid nick message, and the issue is classified as CWE-416. The practical takeaway is simple: if you run or package Irssi, make sure you are on 0.8.21 or later and apply the vendor and distribution advisories linked below.
CVE-2017-5193 is a remotely triggerable denial-of-service issue in Irssi versions before 0.8.21. A message without a nick can drive the nickcmp function into a NULL pointer dereference, crashing the client. The published record classifies this as a high-severity availability problem with no evidence in the corpus of data exposure or code execution.
CVE-2017-5946 is a critical directory traversal issue in rubyzip's Zip::File component. If an application accepts untrusted ZIP uploads and processes them with affected versions, a crafted archive can use "../" path substrings to write files outside the intended extraction location. NVD rates the issue 9.8 with network access, no privileges, and no user interaction, so services that handle user-supplied a [truncated]
CVE-2017-6310 is a high-severity memory-corruption issue in tnef versions before 1.4.13. According to NVD, four type confusions in file_add_mapi_attrs() can lead to attacker-controlled invalid read and write operations. The published CVSS 3.0 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating exploitation requires user interaction and can still have serious confidentiality, integrity, and availability impact.
CVE-2017-6309 is a memory-corruption vulnerability in tnef before 1.4.13. NVD describes two type confusions in parse_file() that can lead to attacker-controlled invalid read and write operations. The official severity is High (CVSS 7.8), but exploitation requires local access and user interaction, so the main risk is to systems that process untrusted TNEF content or that ship affected tnef packages.
CVE-2017-6308 is a memory-corruption issue in tnef versions before 1.4.13. According to NVD, several integer overflows in memory-allocation wrapper functions can lead to heap overflows, creating a high-risk exposure when processing untrusted TNEF content. The vulnerability was published on 2017-02-24 and is scored CVSS 7.8 (High).
CVE-2017-6307 is a high-severity memory corruption issue in tnef before 1.4.13. NVD describes two out-of-bounds writes in src/mapi_attr.c:mapi_attr_read(), with attacker-controlled input potentially leading to invalid read and write operations. The available references indicate that upstream and downstream maintainers issued fixes and advisories, so the main defensive priority is to identify affected vers [truncated]
CVE-2017-6306 is a directory traversal vulnerability in ytnef, affecting versions before 1.9.1. The flaw is tied to filename handling in settings.c (SanitizeFilename), where an attacker could influence path construction and potentially write files outside the intended directory. NVD rates the issue HIGH with a CVSS 3.0 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Public references include Debian, the up [truncated]
CVE-2017-6305 is a high-severity memory-safety issue in ytnef, described by NVD as an out-of-bounds read and write in versions before 1.9.1. The NVD record also ties the issue to Debian-packaged ytnef on Debian 8.0 and 9.0. Because the attack requires local execution conditions and user interaction, the most important defense is to move to a fixed ytnef release and ensure vendor updates are applied on aff [truncated]
CVE-2017-6304 affects ytnef and describes an out-of-bounds read in releases before 1.9.1. NVD rates the issue 7.8 (High) with local attack conditions and required user interaction, so systems that process untrusted input through ytnef should treat it as a serious patching priority.
CVE-2017-6303 is a high-severity memory-corruption issue in ytnef. NVD describes it as an invalid write and integer overflow in versions before 1.9.1, with affected CPEs for ytnef through 1.9 and Debian 8.0/9.0 packages. Because the attack surface includes user interaction and can impact confidentiality, integrity, and availability, systems that process TNEF content through ytnef should be prioritized for [truncated]
CVE-2017-6302 is an integer overflow in ytnef before 1.9.1. NVD rates the issue 7.8 HIGH with a local, low-privilege attack profile and high potential impact to confidentiality, integrity, and availability. The record ties the problem to a patch described as "5 of 9. Integer Overflow" and lists ytnef plus Debian 8.0/9.0 CPEs among the affected entries.
CVE-2017-6301 is a high-severity out-of-bounds read in ytnef, the TNEF parsing utility. NVD classifies it as CWE-125 with a CVSS 3.0 score of 7.8, and the attack conditions require local access plus user interaction, but the impact can still be high across confidentiality, integrity, and availability. Because the supplied source corpus shows a version-boundary mismatch between the CVE description and NVD [truncated]
CVE-2017-6300 is a high-severity buffer overflow in ytnef, fixed before version 1.9.1. The issue is associated with the version field handling in lib/tnef-types.h and is classified by NVD as CWE-119. Because the CVSS vector includes user interaction, defenders should treat this as a dangerous parsing flaw that can be triggered when a user processes untrusted TNEF content.
CVE-2017-6299 is a medium-severity denial-of-service issue in ytnef before 1.9.1. NVD describes it as an infinite loop in the TNEFFillMapi function in lib/ytnef.c, with a CVSS 3.0 vector of AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The supplied references show coordinated remediation through upstream patch discussion and vendor advisories, including Debian and X41.
CVE-2017-6298 affects ytnef before 1.9.1 and is described as a null pointer dereference caused by an unchecked calloc return value (CWE-476). The NVD record assigns CVSS v3.0 7.8 High and indicates local attack conditions with required user interaction. Organizations using ytnef directly or through downstream packages should prioritize updating to a fixed release.
CVE-2016-1245 is a critical memory-corruption flaw in Quagga’s zebra daemon. While processing IPv6 Neighbor Discovery traffic, the code relied on BUFSIZ as if it were a safe match for message size; because BUFSIZ is system-dependent, that assumption could lead to a stack-based buffer overflow and high-impact compromise or disruption.