Repository navigation
Debian unstable release not handled correctly #5754
Description
It appears data on osv.dev indicate that all versions of Debian 12 and 13 package 7zip are vulnerable:
Debian {12-13} / Affected versions / 26.*:
26.00+dfsg-1
26.00+dfsg-2
26.00+dfsg-3
26.00+dfsg-4
26.00+dfsg-5
26.00+dfsg1-1
26.00+dfsg1-2
26.00+dfsg1-3
26.01+dfsg-1
26.01+dfsg-2
26.01+dfsg-3
26.02+dfsg-1 <--- BUG
26.02+dfsg
Debian's CVE tracker states affected versions are:
Bookworm (12) 22.01+really26.01+dfsg-0+deb12u1
Trixie (13) 25.01+dfsg-1~deb13u2
and fix is introduced in 26.02+dfsg-1
Similarly, for package p7zip for Debian 12 data on osv.dev states affected version are:
16.02+dfsg-8
16.02+really25.01+dfsg-0+deb12u1
16.02+really26.01+dfsg-0+deb12u1
16.02+transitional.1 <--- BUG
While Debian states fixed version is 16.02+transitional.1
Activity
jess-lowe commentedon Jul 31, 2026
link to osv record in prod and test for when i have the time to look at this later
jess-lowe commentedon Jul 31, 2026
oh. these are on the unstable version.
related to case 3 in #4161
[-]Data quality issue with DEBIAN-CVE-2026-14266[/-][+]Debian unstable release not handled correctly[/+]github-actions commentedon Oct 3, 2026
This issue has not had any activity for 60 days and will be automatically closed in two weeks
See https://github.com/google/osv.dev/blob/master/CONTRIBUTING.md for how to contribute a PR if you're interested in helping out.
github-actions commentedon Oct 18, 2026
Automatically closing stale issue