{
  "status":"scanned",
  "data":{
     "Layer":{
        "Name": "sha256:b05ac1eeec8635442fa5d3e55d6ef4ad287b9c66055a552c2fd309c334563b0a",
        "NamespaceName": "",
        "IndexedByVersion": 4,
        "ParentName": "",
        "Features":[
           {
              "Name":"tzdata",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2019c-0+deb10u1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"fdisk",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.33.1-0.1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2007-0822",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0822",
                    "FixedBy":"",
                    "Description":"umount, when running with the Linux 2.6.15 kernel on Slackware Linux 10.2, allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensitive information, including core file contents.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"ncurses-base",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"6.1+20181013-2+deb10u1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2019-17594",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17594",
                    "FixedBy":"6.1+20181013-2+deb10u2",
                    "Description":"There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-17595",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17595",
                    "FixedBy":"6.1+20181013-2+deb10u2",
                    "Description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"passwd",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1:4.5-1.1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2002-1594",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1594",
                    "FixedBy":"",
                    "Description":"Buffer overflow in (1) grpck and (2) pwck, if installed setuid on a system as recommended in some AIX documentation, may allow local users to gain privileges via a long command line argument.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2006-1183",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1183",
                    "FixedBy":"",
                    "Description":"The Ubuntu 5.10 installer does not properly clear passwords from the installer log file (questions.dat), and leaves the log file with world-readable permissions, which allows local users to gain privileges.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2006-3597",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3597",
                    "FixedBy":"",
                    "Description":"passwd before 1:4.0.13 on Ubuntu 6.06 LTS leaves the root password blank instead of locking it when the administrator selects the \"Go Back\" option after the final \"Installation complete\" message and uses the main menu, which causes the password to be zeroed out in the installer's memory.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2007-5686",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5686",
                    "FixedBy":"",
                    "Description":"initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts.  NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2013-4235",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235",
                    "FixedBy":"",
                    "Description":"shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2018-16588",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16588",
                    "FixedBy":"",
                    "Description":"Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUSE Linux Enterprise 12 (SLE-12) and through 4.5-5.39 for SUSE Linux Enterprise 15 (SLE-15). Non-existing intermediate directories are created with mode 0777 during user creation. Given that they are world-writable, local attackers might use this for privilege escalation and other unspecified attacks.  NOTE: this would affect non-SUSE users who took useradd.c code from a 2014-04-02 upstream pull request; however, no non-SUSE distribution is known to be affected.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2018-7169",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169",
                    "FixedBy":"",
                    "Description":"An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used \"group blacklisting\" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-19882",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19882",
                    "FixedBy":"",
                    "Description":"shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"perl-base",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"5.28.1-6",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2004-0377",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0377",
                    "FixedBy":"",
                    "Description":"Buffer overflow in the win32_stat function for (1) ActiveState's ActivePerl and (2) Larry Wall's Perl before 5.8.3 allows local or remote attackers to execute arbitrary commands via filenames that end in a backslash character.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2005-4217",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4217",
                    "FixedBy":"",
                    "Description":"Perl in Apple Mac OS X Server 10.3.9 does not properly drop privileges when using the \"$<\" variable to set uid, which allows attackers to gain privileges.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2005-4278",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4278",
                    "FixedBy":"",
                    "Description":"Untrusted search path vulnerability in Perl before 5.8.7-r1 on Gentoo Linux allows local users in the portage group to gain privileges via a malicious shared object in the Portage temporary build directory, which is part of the RUNPATH.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2010-1158",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1158",
                    "FixedBy":"",
                    "Description":"Integer overflow in the regular expression engine in Perl 5.8.x allows context-dependent attackers to cause a denial of service (stack consumption and application crash) by matching a crafted regular expression against a long string.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2011-4116",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4116",
                    "FixedBy":"",
                    "Description":"_is_safe in the File::Temp module for Perl does not properly handle symlinks.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2015-8608",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8608",
                    "FixedBy":"",
                    "Description":"The VDir::MapPathA and VDir::MapPathW functions in Perl 5.22 allow remote attackers to cause a denial of service (out-of-bounds read) and possibly execute arbitrary code via a crafted (1) drive letter or (2) pInName argument.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2017-12814",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12814",
                    "FixedBy":"",
                    "Description":"Stack-based buffer overflow in the CPerlHost::Add method in win32/perlhost.h in Perl before 5.24.3-RC1 and 5.26.x before 5.26.1-RC1 on Windows allows attackers to execute arbitrary code via a long environment variable.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"sed",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"4.7-1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libc6",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.28-10",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2005-0403",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0403",
                    "FixedBy":"",
                    "Description":"init_dev in tty_io.c in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3 does not properly clear controlling tty's in multi-threaded applications, which allows local users to cause a denial of service (crash) and possibly gain tty access via unknown attack vectors that trigger an access of a pointer to a freed structure.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2009-0537",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0537",
                    "FixedBy":"",
                    "Description":"Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service (application crash) via a deep directory tree, related to the fts_level structure member, as demonstrated by (a) du, (b) rm, (c) chmod, and (d) chgrp on OpenBSD; and (e) SearchIndexer.exe on Vista Enterprise.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2010-4051",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4051",
                    "FixedBy":"",
                    "Description":"The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\"",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2010-4052",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4052",
                    "FixedBy":"",
                    "Description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2010-4756",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4756",
                    "FixedBy":"",
                    "Description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2011-0536",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0536",
                    "FixedBy":"",
                    "Description":"Multiple untrusted search path vulnerabilities in elf/dl-object.c in certain modified versions of the GNU C Library (aka glibc or libc6), including glibc-2.5-49.el5_5.6 and glibc-2.12-1.7.el6_0.3 in Red Hat Enterprise Linux, allow local users to gain privileges via a crafted dynamic shared object (DSO) in a subdirectory of the current working directory during execution of a (1) setuid or (2) setgid program that has $ORIGIN in (a) RPATH or (b) RUNPATH within the program itself or a referenced library. NOTE: this issue exists because of an incorrect fix for CVE-2010-3847.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2011-2702",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2702",
                    "FixedBy":"",
                    "Description":"Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization, allows context-dependent attackers to execute arbitrary code via a negative length parameter to (1) memcpy-ssse3-rep.S, (2) memcpy-ssse3.S, or (3) memset-sse2.S in sysdeps/i386/i686/multiarch/, which triggers an out-of-bounds read, as demonstrated using the memcpy function.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2015-5229",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5229",
                    "FixedBy":"",
                    "Description":"The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2016-10228",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10228",
                    "FixedBy":"",
                    "Description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.25 and earlier, when invoked with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2017-17426",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17426",
                    "FixedBy":"",
                    "Description":"The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2018-20796",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20796",
                    "FixedBy":"",
                    "Description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-1010022",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010022",
                    "FixedBy":"",
                    "Description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-1010023",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010023",
                    "FixedBy":"",
                    "Description":"GNU Libc current is affected by: Re-mapping current loaded libray with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-1010024",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010024",
                    "FixedBy":"",
                    "Description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-1010025",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010025",
                    "FixedBy":"",
                    "Description":"** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.\"",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-19126",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19126",
                    "FixedBy":"",
                    "Description":"On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-9192",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9192",
                    "FixedBy":"",
                    "Description":"** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2020-10029",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10029",
                    "FixedBy":"",
                    "Description":"The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2020-1751",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1751",
                    "FixedBy":"",
                    "Description":"",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2020-1752",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1752",
                    "FixedBy":"",
                    "Description":"",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"e2fsprogs",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.44.5-1+deb10u2",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2019-5188",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188",
                    "FixedBy":"1.44.5-1+deb10u3",
                    "Description":"A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libgcc1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1:8.3.0-6",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"gpgv",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.2.12-1+deb10u1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2006-0455",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0455",
                    "FixedBy":"",
                    "Description":"gpgv in GnuPG before 1.4.2.1, when using unattended signature verification, returns a 0 exit code in certain cases even when the detached signature file does not carry a signature, which could cause programs that use gpgv to assume that the signature verification has succeeded.  Note: this also occurs when running the equivalent command \"gpg --verify\".",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2016-6313",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6313",
                    "FixedBy":"",
                    "Description":"The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-14855",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14855",
                    "FixedBy":"",
                    "Description":"A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use this weakness to create forged certificate signatures. This issue affects GnuPG versions before 2.2.18.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libc-bin",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.28-10",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2005-0403",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0403",
                    "FixedBy":"",
                    "Description":"init_dev in tty_io.c in the Red Hat backport of NPTL to Red Hat Enterprise Linux 3 does not properly clear controlling tty's in multi-threaded applications, which allows local users to cause a denial of service (crash) and possibly gain tty access via unknown attack vectors that trigger an access of a pointer to a freed structure.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2009-0537",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0537",
                    "FixedBy":"",
                    "Description":"Integer overflow in the fts_build function in fts.c in libc in (1) OpenBSD 4.4 and earlier and (2) Microsoft Interix 6.0 build 10.0.6030.0 allows context-dependent attackers to cause a denial of service (application crash) via a deep directory tree, related to the fts_level structure member, as demonstrated by (a) du, (b) rm, (c) chmod, and (d) chgrp on OpenBSD; and (e) SearchIndexer.exe on Vista Enterprise.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2010-4051",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4051",
                    "FixedBy":"",
                    "Description":"The regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (application crash) via a regular expression containing adjacent bounded repetitions that bypass the intended RE_DUP_MAX limitation, as demonstrated by a {10,}{10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD, related to a \"RE_DUP_MAX overflow.\"",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2010-4052",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4052",
                    "FixedBy":"",
                    "Description":"Stack consumption vulnerability in the regcomp implementation in the GNU C Library (aka glibc or libc6) through 2.11.3, and 2.12.x through 2.12.2, allows context-dependent attackers to cause a denial of service (resource exhaustion) via a regular expression containing adjacent repetition operators, as demonstrated by a {10,}{10,}{10,}{10,} sequence in the proftpd.gnu.c exploit for ProFTPD.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2010-4756",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4756",
                    "FixedBy":"",
                    "Description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2011-0536",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0536",
                    "FixedBy":"",
                    "Description":"Multiple untrusted search path vulnerabilities in elf/dl-object.c in certain modified versions of the GNU C Library (aka glibc or libc6), including glibc-2.5-49.el5_5.6 and glibc-2.12-1.7.el6_0.3 in Red Hat Enterprise Linux, allow local users to gain privileges via a crafted dynamic shared object (DSO) in a subdirectory of the current working directory during execution of a (1) setuid or (2) setgid program that has $ORIGIN in (a) RPATH or (b) RUNPATH within the program itself or a referenced library. NOTE: this issue exists because of an incorrect fix for CVE-2010-3847.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2011-2702",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2702",
                    "FixedBy":"",
                    "Description":"Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization, allows context-dependent attackers to execute arbitrary code via a negative length parameter to (1) memcpy-ssse3-rep.S, (2) memcpy-ssse3.S, or (3) memset-sse2.S in sysdeps/i386/i686/multiarch/, which triggers an out-of-bounds read, as demonstrated using the memcpy function.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2015-5229",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5229",
                    "FixedBy":"",
                    "Description":"The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to cause a denial of service (hang or crash) via unspecified vectors.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2016-10228",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10228",
                    "FixedBy":"",
                    "Description":"The iconv program in the GNU C Library (aka glibc or libc6) 2.25 and earlier, when invoked with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2017-17426",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17426",
                    "FixedBy":"",
                    "Description":"The malloc function in the GNU C Library (aka glibc or libc6) 2.26 could return a memory block that is too small if an attempt is made to allocate an object whose size is close to SIZE_MAX, potentially leading to a subsequent heap overflow. This occurs because the per-thread cache (aka tcache) feature enables a code path that lacks an integer overflow check.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2018-20796",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20796",
                    "FixedBy":"",
                    "Description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-1010022",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010022",
                    "FixedBy":"",
                    "Description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-1010023",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010023",
                    "FixedBy":"",
                    "Description":"GNU Libc current is affected by: Re-mapping current loaded libray with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-1010024",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010024",
                    "FixedBy":"",
                    "Description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-1010025",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010025",
                    "FixedBy":"",
                    "Description":"** DISPUTED ** GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.\"",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-19126",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19126",
                    "FixedBy":"",
                    "Description":"On the x86-64 architecture, the GNU C Library (aka glibc) before 2.31 fails to ignore the LD_PREFER_MAP_32BIT_EXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for a setuid program.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-9192",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9192",
                    "FixedBy":"",
                    "Description":"** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2020-10029",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10029",
                    "FixedBy":"",
                    "Description":"The GNU C Library (aka glibc or libc6) before 2.32 could overflow an on-stack buffer during range reduction if an input to an 80-bit long double function contains a non-canonical bit pattern, a seen when passing a 0x5d414141414141410000 value to sinl on x86 targets. This is related to sysdeps/ieee754/ldbl-96/e_rem_pio2l.c.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2020-1751",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1751",
                    "FixedBy":"",
                    "Description":"",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2020-1752",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1752",
                    "FixedBy":"",
                    "Description":"",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libtasn1-6",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"4.13-3",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2018-1000654",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000654",
                    "FixedBy":"",
                    "Description":"GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libidn2-0",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.0.5-1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2019-12290",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12290",
                    "FixedBy":"",
                    "Description":"GNU libidn2 before 2.2.0 fails to perform the roundtrip checks specified in RFC3490 Section 4.2 when converting A-labels to U-labels. This makes it possible in some circumstances for one domain to impersonate another. By creating a malicious domain that matches a target domain except for the inclusion of certain punycoded Unicode characters (that would be discarded when converted first to a Unicode label and then back to an ASCII label), arbitrary domains can be impersonated.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-18224",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18224",
                    "FixedBy":"2.0.5-1+deb10u1",
                    "Description":"idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a heap-based buffer overflow via a long domain string.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libselinux1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.8-1+b1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libcap-ng0",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"0.7.9-2",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libpam0g",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.3.1-5",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2003-0388",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0388",
                    "FixedBy":"",
                    "Description":"pam_wheel in Linux-PAM 0.78, with the trust option enabled and the use_uid option disabled, allows local users to spoof log entries and gain privileges by causing getlogin() to return a spoofed user name.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2007-0003",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0003",
                    "FixedBy":"",
                    "Description":"pam_unix.so in Linux-PAM 0.99.7.0 allows context-dependent attackers to log into accounts whose password hash, as stored in /etc/passwd or /etc/shadow, has only two characters.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2010-0832",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0832",
                    "FixedBy":"",
                    "Description":"pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to \"user file stamps\" and the motd.legal-notice file.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2018-17953",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17953",
                    "FixedBy":"",
                    "Description":"A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libpcre3",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2:8.39-12",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2017-11164",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164",
                    "FixedBy":"",
                    "Description":"In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2017-16231",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16231",
                    "FixedBy":"",
                    "Description":"** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of stack that is used.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2017-7245",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7245",
                    "FixedBy":"",
                    "Description":"Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2017-7246",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7246",
                    "FixedBy":"",
                    "Description":"Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libcom-err2",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.44.5-1+deb10u2",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2019-5188",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188",
                    "FixedBy":"1.44.5-1+deb10u3",
                    "Description":"A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libgcrypt20",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.8.4-5",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2019-12904",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12904",
                    "FixedBy":"",
                    "Description":"In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.)",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-13627",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13627",
                    "FixedBy":"",
                    "Description":"It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libunistring2",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"0.9.10-1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libgpg-error0",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.35-1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libsemanage-common",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.8-2",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"diffutils",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1:3.7-3",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"dpkg",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.19.7",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"base-files",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"10.3+deb10u1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2010-0834",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0834",
                    "FixedBy":"",
                    "Description":"The base-files package before 5.0.0ubuntu7.1 on Ubuntu 9.10 and before 5.0.0ubuntu20.10.04.2 on Ubuntu 10.04 LTS, as shipped on Dell Latitude 2110 netbooks, does not require authentication for package installation, which allows remote archive servers and man-in-the-middle attackers to execute arbitrary code via a crafted package.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2018-6557",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6557",
                    "FixedBy":"",
                    "Description":"The MOTD update script in the base-files package in Ubuntu 18.04 LTS before 10.1ubuntu2.2, and Ubuntu 18.10 before 10.1ubuntu6 incorrectly handled temporary files. A local attacker could use this issue to cause a denial of service, or possibly escalate privileges if kernel symlink restrictions were disabled.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"debian-archive-keyring",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2019.1 /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg 9e93d0a43d3a60272034c15900e9df6f /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg f2d1b03b7a3c279ec66425d06aaab50f /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg 4797ff6df738da65413ef710cf73936f /etc/apt/trusted.gpg.d/debian-archive-jessie-automatic.gpg 47d3fff11215d63917b41cb249ca0cbb /etc/apt/trusted.gpg.d/debian-archive-jessie-security-automatic.gpg 762c194d687970dd37e6bbcb1f88be6b /etc/apt/trusted.gpg.d/debian-archive-jessie-stable.gpg 396bc7a1b3a1c2a67b33366b9300897b /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg f8ca9f176f6a5747e113f62220671e0b /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg 986449e3c1ed5c157686f0166411b829 /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg 67fa5396fa0900c0abd1058d98d9247e",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"debianutils",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"4.8.6.1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libmount1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.33.1-0.1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2007-0822",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0822",
                    "FixedBy":"",
                    "Description":"umount, when running with the Linux 2.6.15 kernel on Slackware Linux 10.2, allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensitive information, including core file contents.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libacl1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.2.53-4",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libpam-modules-bin",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.3.1-5",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2003-0388",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0388",
                    "FixedBy":"",
                    "Description":"pam_wheel in Linux-PAM 0.78, with the trust option enabled and the use_uid option disabled, allows local users to spoof log entries and gain privileges by causing getlogin() to return a spoofed user name.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2007-0003",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0003",
                    "FixedBy":"",
                    "Description":"pam_unix.so in Linux-PAM 0.99.7.0 allows context-dependent attackers to log into accounts whose password hash, as stored in /etc/passwd or /etc/shadow, has only two characters.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2010-0832",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0832",
                    "FixedBy":"",
                    "Description":"pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to \"user file stamps\" and the motd.legal-notice file.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2018-17953",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17953",
                    "FixedBy":"",
                    "Description":"A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"init-system-helpers",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.56+nmu1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libapt-pkg5.0",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.8.2",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2011-3374",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3374",
                    "FixedBy":"",
                    "Description":"It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"hostname",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"3.21",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libhogweed4",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"3.4.1-1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"gzip",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.9-3",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2004-0603",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-0603",
                    "FixedBy":"",
                    "Description":"gzexe in gzip 1.3.3 and earlier will execute an argument when the creation of a temp file fails instead of exiting the program, which could allow remote attackers or local users to execute arbitrary commands, a different vulnerability than CVE-1999-1332.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2004-1349",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2004-1349",
                    "FixedBy":"",
                    "Description":"gzip before 1.3 in Solaris 8, when called with the -f or -force flags, will change the permissions of files that are hard linked to the target files, which allows local users to view or modify these files.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libattr1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1:2.4.48-4",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libgmp10",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2:6.1.2+dfsg-4",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"ncurses-bin",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"6.1+20181013-2+deb10u1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2019-17594",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17594",
                    "FixedBy":"6.1+20181013-2+deb10u2",
                    "Description":"There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-17595",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17595",
                    "FixedBy":"6.1+20181013-2+deb10u2",
                    "Description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"adduser",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"3.118",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"tar",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.30+dfsg-6",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2005-2541",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-2541",
                    "FixedBy":"",
                    "Description":"Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-9923",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9923",
                    "FixedBy":"",
                    "Description":"pax_decode_header in sparse.c in GNU Tar before 1.32 had a NULL pointer dereference when parsing certain archives that have malformed extended headers.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"base-passwd",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"3.5.46",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libaudit-common",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1:2.8.4-3",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"util-linux",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.33.1-0.1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2007-0822",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0822",
                    "FixedBy":"",
                    "Description":"umount, when running with the Linux 2.6.15 kernel on Slackware Linux 10.2, allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensitive information, including core file contents.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libdb5.3",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"5.3.28+dfsg1-0.5",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"apt",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.8.2",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2011-3374",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3374",
                    "FixedBy":"",
                    "Description":"It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"mawk",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.3.3-17+b3",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"login",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1:4.5-1.1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2002-1594",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-1594",
                    "FixedBy":"",
                    "Description":"Buffer overflow in (1) grpck and (2) pwck, if installed setuid on a system as recommended in some AIX documentation, may allow local users to gain privileges via a long command line argument.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2006-1183",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-1183",
                    "FixedBy":"",
                    "Description":"The Ubuntu 5.10 installer does not properly clear passwords from the installer log file (questions.dat), and leaves the log file with world-readable permissions, which allows local users to gain privileges.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2006-3597",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3597",
                    "FixedBy":"",
                    "Description":"passwd before 1:4.0.13 on Ubuntu 6.06 LTS leaves the root password blank instead of locking it when the administrator selects the \"Go Back\" option after the final \"Installation complete\" message and uses the main menu, which causes the password to be zeroed out in the installer's memory.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2007-5686",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5686",
                    "FixedBy":"",
                    "Description":"initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts.  NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2013-4235",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4235",
                    "FixedBy":"",
                    "Description":"shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2018-16588",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16588",
                    "FixedBy":"",
                    "Description":"Privilege escalation can occur in the SUSE useradd.c code in useradd, as distributed in the SUSE shadow package through 4.2.1-27.9.1 for SUSE Linux Enterprise 12 (SLE-12) and through 4.5-5.39 for SUSE Linux Enterprise 15 (SLE-15). Non-existing intermediate directories are created with mode 0777 during user creation. Given that they are world-writable, local attackers might use this for privilege escalation and other unspecified attacks.  NOTE: this would affect non-SUSE users who took useradd.c code from a 2014-04-02 upstream pull request; however, no non-SUSE distribution is known to be affected.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2018-7169",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7169",
                    "FixedBy":"",
                    "Description":"An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used \"group blacklisting\" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-19882",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19882",
                    "FixedBy":"",
                    "Description":"shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libblkid1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.33.1-0.1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2007-0822",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0822",
                    "FixedBy":"",
                    "Description":"umount, when running with the Linux 2.6.15 kernel on Slackware Linux 10.2, allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensitive information, including core file contents.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libzstd1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.3.8+dfsg-3",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libuuid1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.33.1-0.1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2007-0822",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0822",
                    "FixedBy":"",
                    "Description":"umount, when running with the Linux 2.6.15 kernel on Slackware Linux 10.2, allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensitive information, including core file contents.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libtinfo6",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"6.1+20181013-2+deb10u1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2019-17594",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17594",
                    "FixedBy":"6.1+20181013-2+deb10u2",
                    "Description":"There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-17595",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17595",
                    "FixedBy":"6.1+20181013-2+deb10u2",
                    "Description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libudev1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"241-7~deb10u1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2013-4392",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4392",
                    "FixedBy":"",
                    "Description":"systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2018-21029",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-21029",
                    "FixedBy":"",
                    "Description":"** DISPUTED ** systemd 239 through 244 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent).",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-15718",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15718",
                    "FixedBy":"241-7~deb10u2",
                    "Description":"In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-20386",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20386",
                    "FixedBy":"",
                    "Description":"An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-3815",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3815",
                    "FixedBy":"",
                    "Description":"A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-3843",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3843",
                    "FixedBy":"",
                    "Description":"It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-3844",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3844",
                    "FixedBy":"",
                    "Description":"It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2020-1712",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1712",
                    "FixedBy":"",
                    "Description":"",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"mount",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.33.1-0.1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2007-0822",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0822",
                    "FixedBy":"",
                    "Description":"umount, when running with the Linux 2.6.15 kernel on Slackware Linux 10.2, allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensitive information, including core file contents.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libsemanage1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.8-2",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libffi6",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"3.2.1-9",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libsepol1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.8-1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"grep",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"3.3-1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libsmartcols1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.33.1-0.1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2007-0822",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0822",
                    "FixedBy":"",
                    "Description":"umount, when running with the Linux 2.6.15 kernel on Slackware Linux 10.2, allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensitive information, including core file contents.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libext2fs2",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.44.5-1+deb10u2",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2019-5188",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188",
                    "FixedBy":"1.44.5-1+deb10u3",
                    "Description":"A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libdebconfclient0",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"0.249",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libstdc++6",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"8.3.0-6",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libnettle6",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"3.4.1-1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"liblz4-1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.8.3-1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2019-17543",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17543",
                    "FixedBy":"",
                    "Description":"LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libp11-kit0",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"0.23.15-2",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"liblzma5",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"5.2.4-1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2015-4035",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4035",
                    "FixedBy":"",
                    "Description":"scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libpam-modules",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.3.1-5",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2003-0388",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0388",
                    "FixedBy":"",
                    "Description":"pam_wheel in Linux-PAM 0.78, with the trust option enabled and the use_uid option disabled, allows local users to spoof log entries and gain privileges by causing getlogin() to return a spoofed user name.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2007-0003",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0003",
                    "FixedBy":"",
                    "Description":"pam_unix.so in Linux-PAM 0.99.7.0 allows context-dependent attackers to log into accounts whose password hash, as stored in /etc/passwd or /etc/shadow, has only two characters.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2010-0832",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0832",
                    "FixedBy":"",
                    "Description":"pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to \"user file stamps\" and the motd.legal-notice file.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2018-17953",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17953",
                    "FixedBy":"",
                    "Description":"A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libbz2-1.0",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.0.6-9.2~deb10u1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"bash",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"5.0-4",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2010-0002",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0002",
                    "FixedBy":"",
                    "Description":"The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LS_OPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-18276",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18276",
                    "FixedBy":"",
                    "Description":"An issue was discovered in disable_priv_mode in shell.c in GNU Bash through 5.0 patch 11. By default, if Bash is run with its effective UID not equal to its real UID, it will drop privileges by setting its effective UID to its real UID. However, it does so incorrectly. On Linux and other systems that support \"saved UID\" functionality, the saved UID is not dropped. An attacker with command execution in the shell can use \"enable -f\" for runtime loading of a new builtin, which can be a shared object that calls setuid() and therefore regains privileges. However, binaries running with an effective UID of 0 are unaffected.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"bsdutils",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1:2.33.1-0.1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"coreutils",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"8.30-3",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2009-4135",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4135",
                    "FixedBy":"",
                    "Description":"The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 allows local users to gain privileges via a symlink attack on a file in a directory tree under /tmp.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2013-0221",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0221",
                    "FixedBy":"",
                    "Description":"The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the sort command, when using the (1) -d or (2) -M switch, which triggers a stack-based buffer overflow in the alloca function.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2013-0222",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0222",
                    "FixedBy":"",
                    "Description":"The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the uniq command, which triggers a stack-based buffer overflow in the alloca function.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2013-0223",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0223",
                    "FixedBy":"",
                    "Description":"The SUSE coreutils-i18n.patch for GNU coreutils allows context-dependent attackers to cause a denial of service (segmentation fault and crash) via a long string to the join command, when using the -i switch, which triggers a stack-based buffer overflow in the alloca function.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2015-4041",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4041",
                    "FixedBy":"",
                    "Description":"The keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 on 64-bit platforms performs a size calculation without considering the number of bytes occupied by multibyte characters, which allows attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via long UTF-8 strings.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2015-4042",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4042",
                    "FixedBy":"",
                    "Description":"Integer overflow in the keycompare_mb function in sort.c in sort in GNU Coreutils through 8.23 might allow attackers to cause a denial of service (application crash) or possibly have unspecified other impact via long strings.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2016-2781",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2781",
                    "FixedBy":"",
                    "Description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2017-18018",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18018",
                    "FixedBy":"",
                    "Description":"In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX \"-R -L\" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libseccomp2",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.3.3-4",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2019-9893",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9893",
                    "FixedBy":"",
                    "Description":"libseccomp before 2.4.0 did not correctly generate 64-bit syscall argument comparisons using the arithmetic operators (LT, GT, LE, GE), which might able to lead to bypassing seccomp filters and potential privilege escalations.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"debconf",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.5.71",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"dash",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"0.5.10.2-5",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2009-0854",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0854",
                    "FixedBy":"",
                    "Description":"Untrusted search path vulnerability in dash 0.5.4, when used as a login shell, allows local users to execute arbitrary code via a Trojan horse .profile file in the current working directory.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libpam-runtime",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.3.1-5",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2003-0388",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0388",
                    "FixedBy":"",
                    "Description":"pam_wheel in Linux-PAM 0.78, with the trust option enabled and the use_uid option disabled, allows local users to spoof log entries and gain privileges by causing getlogin() to return a spoofed user name.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2007-0003",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0003",
                    "FixedBy":"",
                    "Description":"pam_unix.so in Linux-PAM 0.99.7.0 allows context-dependent attackers to log into accounts whose password hash, as stored in /etc/passwd or /etc/shadow, has only two characters.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2010-0832",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0832",
                    "FixedBy":"",
                    "Description":"pam_motd (aka the MOTD module) in libpam-modules before 1.1.0-2ubuntu1.1 in PAM on Ubuntu 9.10 and libpam-modules before 1.1.1-2ubuntu5 in PAM on Ubuntu 10.04 LTS allows local users to change the ownership of arbitrary files via a symlink attack on .cache in a user's home directory, related to \"user file stamps\" and the motd.legal-notice file.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2018-17953",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17953",
                    "FixedBy":"",
                    "Description":"A incorrect variable in a SUSE specific patch for pam_access rule matching in PAM 1.3.0 in openSUSE Leap 15.0 and SUSE Linux Enterprise 15 could lead to pam_access rules not being applied (fail open).",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"gcc-8-base",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"8.3.0-6",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libfdisk1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.33.1-0.1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2007-0822",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0822",
                    "FixedBy":"",
                    "Description":"umount, when running with the Linux 2.6.15 kernel on Slackware Linux 10.2, allows local users to trigger a NULL dereference and application crash by invoking the program with a pathname for a USB pen drive that was mounted and then physically removed, which might allow the users to obtain sensitive information, including core file contents.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libsystemd0",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"241-7~deb10u1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2013-4392",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4392",
                    "FixedBy":"",
                    "Description":"systemd, when updating file permissions, allows local users to change the permissions and SELinux security contexts for arbitrary files via a symlink attack on unspecified files.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2018-21029",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-21029",
                    "FixedBy":"",
                    "Description":"** DISPUTED ** systemd 239 through 244 accepts any certificate signed by a trusted certificate authority for DNS Over TLS. Server Name Indication (SNI) is not sent, and there is no hostname validation with the GnuTLS backend. NOTE: This has been disputed by the developer as not a vulnerability since hostname validation does not have anything to do with this issue (i.e. there is no hostname to be sent).",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-15718",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15718",
                    "FixedBy":"241-7~deb10u2",
                    "Description":"In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-20386",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20386",
                    "FixedBy":"",
                    "Description":"An issue was discovered in button_open in login/logind-button.c in systemd before 243. When executing the udevadm trigger command, a memory leak may occur.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-3815",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3815",
                    "FixedBy":"",
                    "Description":"A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux. Function dispatch_message_real() in journald-server.c does not free the memory allocated by set_iovec_field_free() to store the `_CMDLINE=` entry. A local attacker may use this flaw to make systemd-journald crash. This issue only affects versions shipped with Red Hat Enterprise since v219-62.2.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-3843",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3843",
                    "FixedBy":"",
                    "Description":"It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-3844",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-3844",
                    "FixedBy":"",
                    "Description":"It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2020-1712",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1712",
                    "FixedBy":"",
                    "Description":"",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"findutils",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"4.6.0+git+20190209-2",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"sysvinit-utils",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"2.93-8",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"zlib1g",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1:1.2.11.dfsg-1",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libss2",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1.44.5-1+deb10u2",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2019-5188",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5188",
                    "FixedBy":"1.44.5-1+deb10u3",
                    "Description":"A code execution vulnerability exists in the directory rehashing functionality of E2fsprogs e2fsck 1.45.4. A specially crafted ext4 directory can cause an out-of-bounds write on the stack, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libaudit1",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"1:2.8.4-3",
              "Vulnerabilities":[

              ]
           },
           {
              "Name":"libgnutls30",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"3.6.7-4",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2009-5138",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5138",
                    "FixedBy":"",
                    "Description":"GnuTLS before 2.7.6, when the GNUTLS_VERIFY_ALLOW_X509_V1_CA_CRT flag is not enabled, treats version 1 X.509 certificates as intermediate CAs, which allows remote attackers to bypass intended restrictions by leveraging a X.509 V1 certificate from a trusted CA to issue new certificates, a different vulnerability than CVE-2014-1959.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2013-4466",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4466",
                    "FixedBy":"",
                    "Description":"Buffer overflow in the dane_query_tlsa function in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.15 and 3.2.x before 3.2.5 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2013-4487",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4487",
                    "FixedBy":"",
                    "Description":"Off-by-one error in the dane_raw_tlsa in the DANE library (libdane) in GnuTLS 3.1.x before 3.1.16 and 3.2.x before 3.2.6 allows remote servers to cause a denial of service (memory corruption) via a response with more than four DANE entries.  NOTE: this issue is due to an incomplete fix for CVE-2013-4466.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2014-8155",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8155",
                    "FixedBy":"",
                    "Description":"GnuTLS before 2.9.10 does not verify the activation and expiration dates of CA certificates, which allows man-in-the-middle attackers to spoof servers via a certificate issued by a CA certificate that is (1) not yet valid or (2) no longer valid.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2015-0282",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0282",
                    "FixedBy":"",
                    "Description":"GnuTLS before 3.1.0 does not verify that the RSA PKCS #1 signature algorithm matches the signature algorithm in the certificate, which allows remote attackers to conduct downgrade attacks via unspecified vectors.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2015-8313",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8313",
                    "FixedBy":"",
                    "Description":"GnuTLS incorrectly validates the first byte of padding in CBC modes",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           },
           {
              "Name":"libncursesw6",
              "VersionFormat":"",
              "NamespaceName":"",
              "AddedBy":"sha256:8d691f585fa8cec0eba196be460cfaffd69939782d6162986c3e0c5225d54f02",
              "Version":"6.1+20181013-2+deb10u1",
              "Vulnerabilities":[
                 {
                    "Name":"CVE-2019-17594",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17594",
                    "FixedBy":"6.1+20181013-2+deb10u2",
                    "Description":"There is a heap-based buffer over-read in the _nc_find_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
                    "Severity":"Unknown",
                    "Metadata": null
                 },
                 {
                    "Name":"CVE-2019-17595",
                    "NamespaceName":"",
                    "Link":"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17595",
                    "FixedBy":"6.1+20181013-2+deb10u2",
                    "Description":"There is a heap-based buffer over-read in the fmt_entry function in tinfo/comp_hash.c in the terminfo library in ncurses before 6.1-20191012.",
                    "Severity":"Unknown",
                    "Metadata": null
                 }
              ]
           }
        ]
     }
  }
}
