Skip to content

Ecocyc 29.1 #355

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 5 commits into from
Sep 22, 2025
Merged

Ecocyc 29.1 #355

merged 5 commits into from
Sep 22, 2025

Conversation

@thalassemia
Copy link
Contributor

@thalassemia thalassemia commented Sep 14, 2025

EcoCyc 29.1

I copied the flat files from wcEcoli commit b5128d0 to update to EcoCyc 29.1.

Fix slow doubling time due to relaxed ParCa fitness threshold

The relaxed fitness threshold I set in the ParCa as part of updating Python dependencies in #260 results in significantly longer average doubling time. The ParCa seems to converge on Sherlock now with the original 1e-9 threshold, so I reset it back to that. On my desktop, this brings the average doubling time back in line with wcEcoli commit b5128d0 (all plots below generated with default simulation options, 16 seeds, 32 generations, ignoring first 4 generations).

vEcoli 3.3e-8

visualization(7)

vEcoli 1e-9

visualization(6)

wcEcoli

Screenshot from 2025-09-14 00-14-37

Fix incomplete parquet write when issuing ctrl+C to runscripts/sim.py

Finally, I fixed a bug in runscripts/sim.py that caused a second SIGINT to be sent when a KeyboardInterrupt (e.g. control-C) is received, preventing the final parquet file from being written.

@github-actions
Copy link
Contributor

github-actions bot commented Sep 14, 2025 •
edited
Loading

🔍 Vulnerabilities of vecoli:latest

📦 Image Reference vecoli:latest
digestsha256:33bfbd8131d2cb93a25070448a82d7e09e085c89d43c5d68c4951777ee9434c7
vulnerabilitiescritical: 0 high: 5 medium: 9 low: 64 unspecified: 2
platformlinux/amd64
size782 MB
packages417
📦 Base Image oisupport/staging-amd64:12-slim
also known as
  • 12.11-slim
  • b4697ad8e75338499fc9a37305cbe60bd76873caa23ab99f3e329370faf7b4e0
  • bookworm-slim
digestsha256:364d3f277f79b11fafee2f44e8198054486583d3392e2472eb656d5c780156f5
vulnerabilitiescritical: 0 high: 3 medium: 7 low: 10
critical: 0 high: 2 medium: 1 low: 0 expat 2.5.0-1+deb12u1 (deb)

pkg:deb/debian/expat@2.5.0-1%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

high : CVE--2024--8176

Affected range<2.5.0-1+deb12u2
Fixed version2.5.0-1+deb12u2
EPSS Score0.505%
EPSS Percentile65th percentile
Description

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.

high : CVE--2023--52425

Affected range<2.5.0-1+deb12u2
Fixed version2.5.0-1+deb12u2
EPSS Score0.677%
EPSS Percentile71st percentile
Description

libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large token for which multiple buffer fills are needed.

medium : CVE--2024--50602

Affected range<2.5.0-1+deb12u2
Fixed version2.5.0-1+deb12u2
EPSS Score0.068%
EPSS Percentile22nd percentile
Description

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

critical: 0 high: 1 medium: 1 low: 0 glibc 2.36-9+deb12u10 (deb)

pkg:deb/debian/glibc@2.36-9%2Bdeb12u10?os_distro=bookworm&os_name=debian&os_version=12

high : CVE--2025--4802

Affected range<2.36-9+deb12u11
Fixed version2.36-9+deb12u11
EPSS Score0.008%
EPSS Percentile1st percentile
Description

Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).

medium : CVE--2025--8058

Affected range<2.36-9+deb12u13
Fixed version2.36-9+deb12u13
EPSS Score0.018%
EPSS Percentile3rd percentile
Description

The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.

critical: 0 high: 1 medium: 1 low: 0 perl 5.36.0-7+deb12u2 (deb)

pkg:deb/debian/perl@5.36.0-7%2Bdeb12u2?os_distro=bookworm&os_name=debian&os_version=12

high : CVE--2023--31484

Affected range<5.36.0-7+deb12u3
Fixed version5.36.0-7+deb12u3
EPSS Score0.911%
EPSS Percentile75th percentile
Description

CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.

[experimental] - perl 5.38.0~rc2-1

medium : CVE--2025--40909

Affected range<5.36.0-7+deb12u3
Fixed version5.36.0-7+deb12u3
EPSS Score0.007%
EPSS Percentile0th percentile
Description

Perl threads have a working directory race condition where file operations may target unintended paths. If a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. This may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit. The bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6

[experimental] - perl 5.40.1-4

critical: 0 high: 1 medium: 0 low: 0 pam 1.5.2-6+deb12u1 (deb)

pkg:deb/debian/pam@1.5.2-6%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

high : CVE--2025--6020

Affected range>=1.5.2-6+deb12u1
Fixed versionNot Fixed
EPSS Score0.026%
EPSS Percentile6th percentile
Description

A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.

[experimental] - pam 1.7.0-4

critical: 0 high: 0 medium: 3 low: 1 gnutls28 3.7.9-2+deb12u4 (deb)

pkg:deb/debian/gnutls28@3.7.9-2%2Bdeb12u4?os_distro=bookworm&os_name=debian&os_version=12

medium : CVE--2025--6395

Affected range<3.7.9-2+deb12u5
Fixed version3.7.9-2+deb12u5
EPSS Score0.057%
EPSS Percentile18th percentile
Description

A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().

medium : CVE--2025--32990

Affected range<3.7.9-2+deb12u5
Fixed version3.7.9-2+deb12u5
EPSS Score0.072%
EPSS Percentile23rd percentile
Description

A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.

medium : CVE--2025--32988

Affected range<3.7.9-2+deb12u5
Fixed version3.7.9-2+deb12u5
EPSS Score0.056%
EPSS Percentile18th percentile
Description

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.

low : CVE--2025--32989

Affected range<3.7.9-2+deb12u5
Fixed version3.7.9-2+deb12u5
EPSS Score0.026%
EPSS Percentile6th percentile
Description

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.

critical: 0 high: 0 medium: 1 low: 1 tar 1.34+dfsg-1.2+deb12u1 (deb)

pkg:deb/debian/tar@1.34%2Bdfsg-1.2%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

medium : CVE--2025--45582

Affected range>=1.34+dfsg-1.2+deb12u1
Fixed versionNot Fixed
EPSS Score0.042%
EPSS Percentile12th percentile
Description

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of "Member name contains '..'" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain "x -> ../../../../../home/victim/.ssh" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which "tar xf" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages).

Disputed tar issue, works as documented per upstream:
https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html
https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md

low : CVE--2005--2541

Affected range>=1.34+dfsg-1.2+deb12u1
Fixed versionNot Fixed
EPSS Score3.250%
EPSS Percentile87th percentile
Description

Tar 1.15.1 does not properly warn the user when extracting setuid or setgid files, which may allow local users or remote attackers to gain privileges.

This is intended behaviour, after all tar is an archiving tool and you
need to give -p as a command line flag

critical: 0 high: 0 medium: 1 low: 0 krb5 1.20.1-2+deb12u3 (deb)

pkg:deb/debian/krb5@1.20.1-2%2Bdeb12u3?os_distro=bookworm&os_name=debian&os_version=12

medium : CVE--2025--3576

Affected range<1.20.1-2+deb12u4
Fixed version1.20.1-2+deb12u4
EPSS Score0.030%
EPSS Percentile7th percentile
Description

A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.

critical: 0 high: 0 medium: 1 low: 0 systemd 252.36-1~deb12u1 (deb)

pkg:deb/debian/systemd@252.36-1~deb12u1?os_distro=bookworm&os_name=debian&os_version=12

medium : CVE--2025--4598

Affected range<252.38-1~deb12u1
Fixed version252.38-1~deb12u1
EPSS Score0.037%
EPSS Percentile10th percentile
Description

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process. A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

critical: 0 high: 0 medium: 0 low: 29 binutils 2.40-2 (deb)

pkg:deb/debian/binutils@2.40-2?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2025--8225

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.019%
EPSS Percentile3rd percentile
Description

A vulnerability was found in GNU Binutils 2.44 and classified as problematic. This issue affects the function process_debug_info of the file binutils/dwarf.c of the component DWARF Section Handler. The manipulation leads to memory leak. Attacking locally is a requirement. The identifier of the patch is e51fdff7d2e538c0e5accdd65649ac68e6e0ddd4. It is recommended to apply a patch to fix this issue.

low : CVE--2025--8224

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.023%
EPSS Percentile4th percentile
Description

A vulnerability has been found in GNU Binutils 2.44 and classified as problematic. This vulnerability affects the function bfd_elf_get_str_section of the file bfd/elf.c of the component BFD Library. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is db856d41004301b3a56438efd957ef5cabb91530. It is recommended to apply a patch to fix this issue.

low : CVE--2025--7546

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.015%
EPSS Percentile2nd percentile
Description

A vulnerability, which was classified as problematic, has been found in GNU Binutils 2.45. Affected by this issue is the function bfd_elf_set_group_contents of the file bfd/elf.c. The manipulation leads to out-of-bounds write. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The name of the patch is 41461010eb7c79fee7a9d5f6209accdaac66cc6b. It is recommended to apply a patch to fix this issue.

low : CVE--2025--7545

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.014%
EPSS Percentile2nd percentile
Description

A vulnerability classified as problematic was found in GNU Binutils 2.45. Affected by this vulnerability is the function copy_section of the file binutils/objcopy.c. The manipulation leads to heap-based buffer overflow. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The patch is named 08c3cbe5926e4d355b5cb70bbec2b1eeb40c2944. It is recommended to apply a patch to fix this issue.

low : CVE--2025--5245

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.022%
EPSS Percentile4th percentile
Description

A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of the component objdump. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

low : CVE--2025--5244

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.022%
EPSS Percentile4th percentile
Description

A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.45 is able to address this issue. It is recommended to upgrade the affected component.

low : CVE--2025--3198

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.016%
EPSS Percentile2nd percentile
Description

A vulnerability has been found in GNU Binutils 2.43/2.44 and classified as problematic. Affected by this vulnerability is the function display_info of the file binutils/bucomm.c of the component objdump. The manipulation leads to memory leak. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The patch is named ba6ad3a18cb26b79e0e3b84c39f707535bbc344d. It is recommended to apply a patch to fix this issue.

low : CVE--2025--1182

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.157%
EPSS Percentile37th percentile
Description

A vulnerability, which was classified as critical, was found in GNU Binutils 2.43. Affected is the function bfd_elf_reloc_symbol_deleted_p of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The patch is identified as b425859021d17adf62f06fb904797cf8642986ad. It is recommended to apply a patch to fix this issue.

low : CVE--2025--1181

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.210%
EPSS Percentile43rd percentile
Description

A vulnerability classified as critical was found in GNU Binutils 2.43. This vulnerability affects the function _bfd_elf_gc_mark_rsec of the file bfd/elflink.c of the component ld. The manipulation leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 931494c9a89558acb36a03a340c01726545eef24. It is recommended to apply a patch to fix this issue.

low : CVE--2025--1180

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.143%
EPSS Percentile35th percentile
Description

A vulnerability classified as problematic has been found in GNU Binutils 2.43. This affects the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component ld. The manipulation leads to memory corruption. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue.

low : CVE--2025--1179

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.162%
EPSS Percentile38th percentile
Description

A vulnerability was found in GNU Binutils 2.43. It has been rated as critical. Affected by this issue is the function bfd_putl64 of the file bfd/libbfd.c of the component ld. The manipulation leads to memory corruption. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. It is recommended to upgrade the affected component. The code maintainer explains, that "[t]his bug has been fixed at some point between the 2.43 and 2.44 releases".

low : CVE--2025--1178

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.183%
EPSS Percentile40th percentile
Description

A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. Affected by this vulnerability is the function bfd_putl64 of the file libbfd.c of the component ld. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is 75086e9de1707281172cc77f178e7949a4414ed0. It is recommended to apply a patch to fix this issue.

low : CVE--2025--1176

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.156%
EPSS Percentile37th percentile
Description

A vulnerability was found in GNU Binutils 2.43 and classified as critical. This issue affects the function _bfd_elf_gc_mark_rsec of the file elflink.c of the component ld. The manipulation leads to heap-based buffer overflow. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The patch is named f9978defb6fab0bd8583942d97c112b0932ac814. It is recommended to apply a patch to fix this issue.

low : CVE--2025--1153

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.212%
EPSS Percentile44th percentile
Description

A vulnerability classified as problematic was found in GNU Binutils 2.43/2.44. Affected by this vulnerability is the function bfd_set_format of the file format.c. The manipulation leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 2.45 is able to address this issue. The identifier of the patch is 8d97c1a53f3dc9fd8e1ccdb039b8a33d50133150. It is recommended to upgrade the affected component.

low : CVE--2025--1152

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.093%
EPSS Percentile27th percentile
Description

A vulnerability classified as problematic has been found in GNU Binutils 2.43. Affected is the function xstrdup of the file xstrdup.c of the component ld. The manipulation leads to memory leak. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."

low : CVE--2025--1151

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.086%
EPSS Percentile26th percentile
Description

A vulnerability was found in GNU Binutils 2.43. It has been rated as problematic. This issue affects the function xmemdup of the file xmemdup.c of the component ld. The manipulation leads to memory leak. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."

low : CVE--2025--1150

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.093%
EPSS Percentile27th percentile
Description

A vulnerability was found in GNU Binutils 2.43. It has been declared as problematic. This vulnerability affects the function bfd_malloc of the file libbfd.c of the component ld. The manipulation leads to memory leak. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."

low : CVE--2025--1149

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.093%
EPSS Percentile27th percentile
Description

A vulnerability was found in GNU Binutils 2.43. It has been classified as problematic. This affects the function xstrdup of the file libiberty/xmalloc.c of the component ld. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."

low : CVE--2025--1148

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.208%
EPSS Percentile43rd percentile
Description

A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Affected by this issue is the function link_order_scan of the file ld/ldelfgen.c of the component ld. The manipulation leads to memory leak. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The code maintainer explains: "I'm not going to commit some of the leak fixes I've been working on to the 2.44 branch due to concern that would destabilise ld. All of the reported leaks in this bugzilla have been fixed on binutils master."

low : CVE--2025--1147

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.187%
EPSS Percentile41st percentile
Description

A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitizer::internal_strlen of the file binutils/nm.c of the component nm. The manipulation of the argument const leads to buffer overflow. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.

low : CVE--2025--0840

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.175%
EPSS Percentile39th percentile
Description

A vulnerability, which was classified as problematic, was found in GNU Binutils up to 2.43. This affects the function disassemble_bytes of the file binutils/objdump.c. The manipulation of the argument buf leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.44 is able to address this issue. The identifier of the patch is baac6c221e9d69335bf41366a1c7d87d8ab2f893. It is recommended to upgrade the affected component.

low : CVE--2024--57360

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.024%
EPSS Percentile5th percentile
Description

https://www.gnu.org/software/binutils/ nm >=2.43 is affected by: Incorrect Access Control. The type of exploitation is: local. The component is: nm --without-symbol-version function.

low : CVE--2024--53589

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.043%
EPSS Percentile13th percentile
Description

GNU objdump 2.43 is vulnerable to Buffer Overflow in the BFD (Binary File Descriptor) library's handling of tekhex format files.

low : CVE--2023--1972

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.045%
EPSS Percentile13th percentile
Description

A potential heap based buffer overflow was found in _bfd_elf_slurp_version_tables() in bfd/elf.c. This may lead to loss of availability.

low : CVE--2021--32256

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.115%
EPSS Percentile31st percentile
Description

An issue was discovered in GNU libiberty, as distributed in GNU Binutils 2.36. It is a stack-overflow issue in demangle_type in rust-demangle.c.

low : CVE--2018--9996

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.385%
EPSS Percentile59th percentile
Description

An issue was discovered in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.30. Stack Exhaustion occurs in the C++ demangling functions provided by libiberty, and there are recursive stack frames: demangle_template_value_parm, demangle_integral_value, and demangle_expression.

low : CVE--2018--20712

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score1.070%
EPSS Percentile77th percentile
Description

A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty, as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults, leading to denial-of-service, as demonstrated by c++filt.

low : CVE--2018--20673

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.119%
EPSS Percentile32nd percentile
Description

The demangle_template function in cplus-dem.c in GNU libiberty, as distributed in GNU Binutils 2.31.1, contains an integer overflow vulnerability (for "Create an array for saving the template argument values") that can trigger a heap-based buffer overflow, as demonstrated by nm.

low : CVE--2017--13716

Affected range>=2.40-2
Fixed versionNot Fixed
EPSS Score0.196%
EPSS Percentile42nd percentile
Description

The C++ symbol demangler routine in cplus-dem.c in libiberty, as distributed in GNU Binutils 2.29, allows remote attackers to cause a denial of service (excessive memory allocation and application crash) via a crafted file, as demonstrated by a call from the Binary File Descriptor (BFD) library (aka libbfd).

critical: 0 high: 0 medium: 0 low: 15 unspecified: 2tiff 4.5.0-6+deb12u2 (deb)

pkg:deb/debian/tiff@4.5.0-6%2Bdeb12u2?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2025--9165

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.020%
EPSS Percentile4th percentile
Description

A flaw has been found in LibTIFF 4.7.0. This affects the function _TIFFmallocExt/_TIFFCheckRealloc/TIFFHashSetNew/InitCCITTFax3 of the file tools/tiffcmp.c of the component tiffcmp. Executing manipulation can lead to memory leak. The attack is restricted to local execution. The exploit has been published and may be used. This patch is called ed141286a37f6e5ddafb5069347ff5d587e7a4e0. It is best practice to apply a patch to resolve this issue.

low : CVE--2025--8851

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.018%
EPSS Percentile3rd percentile
Description

A vulnerability was determined in LibTIFF up to 4.5.1. Affected by this issue is the function readSeparateStripsetoBuffer of the file tools/tiffcrop.c of the component tiffcrop. The manipulation leads to stack-based buffer overflow. Local access is required to approach this attack. The patch is identified as 8a7a48d7a645992ca83062b3a1873c951661e2b3. It is recommended to apply a patch to fix this issue.

low : CVE--2025--8534

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.025%
EPSS Percentile5th percentile
Description

A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the component tiff2ps. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 6ba36f159fd396ad11bf6b7874554197736ecc8b. It is recommended to apply a patch to fix this issue. One of the maintainers explains, that "[t]his error only occurs if DEFER_STRILE_LOAD (defer-strile-load:BOOL=ON) or TIFFOpen( .. "rD") option is used."

low : CVE--2025--8177

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.015%
EPSS Percentile2nd percentile
Description

A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The manipulation leads to buffer overflow. An attack has to be approached locally. The patch is named e8c9d6c616b19438695fd829e58ae4fde5bfbc22. It is recommended to apply a patch to fix this issue. This vulnerability only affects products that are no longer supported by the maintainer.

low : CVE--2025--8176

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.015%
EPSS Percentile2nd percentile
Description

A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tiffmedian.c. The manipulation leads to use after free. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The patch is identified as fe10872e53efba9cc36c66ac4ab3b41a839d5172. It is recommended to apply a patch to fix this issue.

low : CVE--2024--6716

Affected range>=4.5.0-6+deb12u1
Fixed versionNot Fixed
EPSS Score0.043%
EPSS Percentile12th percentile
Description

REJECTED

REJECTED

low : CVE--2023--6228

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.016%
EPSS Percentile2nd percentile
Description

An issue was found in the tiffcp utility distributed by the libtiff package where a crafted TIFF file on processing may cause a heap-based buffer overflow leads to an application crash.

low : CVE--2023--3164

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.010%
EPSS Percentile1st percentile
Description

A heap-buffer-overflow vulnerability was found in LibTIFF, in extractImageSection() at tools/tiffcrop.c:7916 and tools/tiffcrop.c:7801. This flaw allows attackers to cause a denial of service via a crafted tiff file.

low : CVE--2023--1916

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.017%
EPSS Percentile3rd percentile
Description

A flaw was found in tiffcrop, a program distributed by the libtiff package. A specially crafted tiff file can lead to an out-of-bounds read in the extractImageSection function in tools/tiffcrop.c, resulting in a denial of service and limited information disclosure. This issue affects libtiff versions 4.x.

low : CVE--2022--1210

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.047%
EPSS Percentile14th percentile
Description

A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used.

low : CVE--2018--10126

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.313%
EPSS Percentile54th percentile
Description

ijg-libjpeg before 9d, as used in tiff2pdf (from LibTIFF) and other products, does not check for a NULL pointer at a certain place in jpeg_fdct_16x16 in jfdctint.c.

low : CVE--2017--9117

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.098%
EPSS Percentile28th percentile
Description

In LibTIFF 4.0.6 and possibly other versions, the program processes BMP images without verifying that biWidth and biHeight in the bitmap-information header match the actual input, as demonstrated by a heap-based buffer over-read in bmp2tiff. NOTE: mentioning bmp2tiff does not imply that the activation point is in the bmp2tiff.c file (which was removed before the 4.0.7 release).

low : CVE--2017--5563

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.457%
EPSS Percentile63rd percentile
Description

LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.

low : CVE--2017--17973

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score0.419%
EPSS Percentile61st percentile
Description

In LibTIFF 4.0.8, there is a heap-based use-after-free in the t2p_writeproc function in tiff2pdf.c. NOTE: there is a third-party report of inability to reproduce this issue

low : CVE--2017--16232

Affected range>=4.5.0-6+deb12u2
Fixed versionNot Fixed
EPSS Score1.738%
EPSS Percentile82nd percentile
Description

LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue

unspecified : CVE--2023--38289

Affected range>=4.5.0-6
Fixed versionNot Fixed
Description

REJECTED

REJECTED

unspecified : CVE--2023--38288

Affected range>=4.5.0-6
Fixed versionNot Fixed
Description

REJECTED

REJECTED

critical: 0 high: 0 medium: 0 low: 4 openldap 2.5.13+dfsg-5 (deb)

pkg:deb/debian/openldap@2.5.13%2Bdfsg-5?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2020--15719

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
EPSS Score0.371%
EPSS Percentile58th percentile
Description

libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.

low : CVE--2017--17740

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
EPSS Score2.838%
EPSS Percentile86th percentile
Description

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

low : CVE--2017--14159

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
EPSS Score0.113%
EPSS Percentile31st percentile
Description

slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill cat /pathname" command, as demonstrated by openldap-initscript.

low : CVE--2015--3276

Affected range>=2.5.13+dfsg-5
Fixed versionNot Fixed
EPSS Score1.757%
EPSS Percentile82nd percentile
Description

The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors.

  • openldap (unimportant)
    Debian builds with GNUTLS, not NSS
critical: 0 high: 0 medium: 0 low: 2 coreutils 9.1-1 (deb)

pkg:deb/debian/coreutils@9.1-1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2025--5278

Affected range>=9.1-1
Fixed versionNot Fixed
EPSS Score0.018%
EPSS Percentile3rd percentile
Description

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

low : CVE--2017--18018

Affected range>=9.1-1
Fixed versionNot Fixed
EPSS Score0.056%
EPSS Percentile17th percentile
Description

In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not prevent replacement of a plain file with a symlink during use of the POSIX "-R -L" options, which allows local users to modify the ownership of arbitrary files by leveraging a race condition.

critical: 0 high: 0 medium: 0 low: 2 libgcrypt20 1.10.1-3 (deb)

pkg:deb/debian/libgcrypt20@1.10.1-3?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2024--2236

Affected range>=1.10.1-3
Fixed versionNot Fixed
EPSS Score0.301%
EPSS Percentile53rd percentile
Description

A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts.

low : CVE--2018--6829

Affected range>=1.10.1-3
Fixed versionNot Fixed
EPSS Score0.549%
EPSS Percentile67th percentile
Description

cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.

critical: 0 high: 0 medium: 0 low: 2 libheif 1.15.1-1+deb12u1 (deb)

pkg:deb/debian/libheif@1.15.1-1%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2024--25269

Affected range>=1.15.1-1+deb12u1
Fixed versionNot Fixed
EPSS Score0.059%
EPSS Percentile19th percentile
Description

libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. This flaw allows an attacker to cause a denial of service attack.

low : CVE--2023--49463

Affected range>=1.15.1-1+deb12u1
Fixed versionNot Fixed
EPSS Score0.146%
EPSS Percentile36th percentile
Description

libheif v1.17.5 was discovered to contain a segmentation violation via the function find_exif_tag at /libheif/exif.cc.

critical: 0 high: 0 medium: 0 low: 1 libpng1.6 1.6.39-2 (deb)

pkg:deb/debian/libpng1.6@1.6.39-2?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2021--4214

Affected range>=1.6.39-2
Fixed versionNot Fixed
EPSS Score0.076%
EPSS Percentile24th percentile
Description

A heap overflow flaw was found in libpngs' pngimage.c program. This flaw allows an attacker with local network access to pass a specially crafted PNG file to the pngimage utility, causing an application to crash, leading to a denial of service.

critical: 0 high: 0 medium: 0 low: 1 apt 2.6.1 (deb)

pkg:deb/debian/apt@2.6.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2011--3374

Affected range>=2.6.1
Fixed versionNot Fixed
EPSS Score1.509%
EPSS Percentile81st percentile
Description

It was found that apt-key in apt, all versions, do not correctly validate gpg keys with the master keyring, leading to a potential man-in-the-middle attack.

critical: 0 high: 0 medium: 0 low: 1 util-linux 2.38.1-5+deb12u3 (deb)

pkg:deb/debian/util-linux@2.38.1-5%2Bdeb12u3?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--0563

Affected range>=2.38.1-5+deb12u3
Fixed versionNot Fixed
EPSS Score0.025%
EPSS Percentile5th percentile
Description

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

critical: 0 high: 0 medium: 0 low: 1 openssl 3.0.16-1~deb12u1 (deb)

pkg:deb/debian/openssl@3.0.16-1~deb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2010--0928

Affected range>=3.0.11-1~deb12u2
Fixed versionNot Fixed
EPSS Score0.109%
EPSS Percentile30th percentile
Description

OpenSSL 0.9.8i on the Gaisler Research LEON3 SoC on the Xilinx Virtex-II Pro FPGA uses a Fixed Width Exponentiation (FWE) algorithm for certain signature calculations, and does not verify the signature before providing it to a caller, which makes it easier for physically proximate attackers to determine the private key via a modified supply voltage for the microprocessor, related to a "fault-based attack."

http://www.eecs.umich.edu/~valeria/research/publications/DATE10RSA.pdf
openssl/openssl#24540
Fault injection based attacks are not within OpenSSLs threat model according
to the security policy: https://www.openssl.org/policies/general/security-policy.html

critical: 0 high: 0 medium: 0 low: 1 jansson 2.14-2 (deb)

pkg:deb/debian/jansson@2.14-2?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2020--36325

Affected range>=2.14-2
Fixed versionNot Fixed
EPSS Score0.323%
EPSS Percentile55th percentile
Description

An issue was discovered in Jansson through 2.13.1. Due to a parsing error in json_loads, there's an out-of-bounds read-access bug. NOTE: the vendor reports that this only occurs when a programmer fails to follow the API specification

critical: 0 high: 0 medium: 0 low: 1 gcc-12 12.2.0-14+deb12u1 (deb)

pkg:deb/debian/gcc-12@12.2.0-14%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2022--27943

Affected range>=12.2.0-14+deb12u1
Fixed versionNot Fixed
EPSS Score0.050%
EPSS Percentile15th percentile
Description

libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.

critical: 0 high: 0 medium: 0 low: 1 jbigkit 2.1-6.1 (deb)

pkg:deb/debian/jbigkit@2.1-6.1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2017--9937

Affected range>=2.1-6.1
Fixed versionNot Fixed
EPSS Score0.354%
EPSS Percentile57th percentile
Description

In LibTIFF 4.0.8, there is a memory malloc failure in tif_jbig.c. A crafted TIFF document can lead to an abort resulting in a remote denial of service attack.

critical: 0 high: 0 medium: 0 low: 1 shadow 1:4.13+dfsg1-1+deb12u1 (deb)

pkg:deb/debian/shadow@1%3A4.13%2Bdfsg1-1%2Bdeb12u1?os_distro=bookworm&os_name=debian&os_version=12

low : CVE--2007--5686

Affected range>=1:4.13+dfsg1-1+deb12u1
Fixed versionNot Fixed
EPSS Score0.362%
EPSS Percentile58th percentile
Description

initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to obtain sensitive information regarding authentication attempts. NOTE: because sshd detects the insecure permissions and does not log certain events, this also prevents sshd from logging failed authentication attempts by remote attackers.

  • shadow (unimportant)
    See #290803, on Debian LOG_UNKFAIL_ENAB in login.defs is set to no so
    unknown usernames are not recorded on login failures

@github-actions
Copy link
Contributor

github-actions bot commented Sep 14, 2025 •
edited
Loading

Recommended fixes for image vecoli:latest

Base image is :12-slim

Digest
Vulnerabilities
Size0 B
Packages0

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

@thalassemia thalassemia merged commit 6667ec1 into master Sep 22, 2025
11 checks passed
@thalassemia thalassemia deleted the ecocyc-29.1 branch September 22, 2025 22:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@thalassemia