OPENSUSE-SU-2026:21891-1
Vulnerability from csaf_opensuse - Published: 2026-09-20 14:11 - Updated: 2026-09-24 17:48Summary
Security update for ant
Severity
Important
Notes
Title of the patch: Security update for ant
Description of the patch: This update for ant fixes the following issues:
- CVE-2021-36374: excessive memory allocation when reading a specially crafted ZIP archive or a derived formats
(bsc#1188469).
- CVE-2025-7962: jakarta: improper neutralization of \r and \n UTF-8 characters can lead to SMTP injection
(bsc#1246873).
- CVE-2026-78254: path traversal in ftp and scp tasks allows for arbitrary file writes (bsc#1280015).
Changes for ant:
- Upgrade to version 1.10.18
* Breaking changes:
+ the default value for <ftp>'s useSecureDataChannel has been
changed to true which means using ftps now also tries to use
an encrypted data channel by default.
+ the <ftp> and <scp> tasks have new allowFilesToEscapeDest
attributes. When set to false - which is the default - the
tasks will not download files or create directories outside
the designated destination directory when downloading from the
remote server. In the unlikely case you need the old bahaviour
of writing outside the destination directory you must set the
value to true explicitly.
* Other changes:
+ when using the SOURCE_DATE_EPOCH environment variable to set
the time for <tstamp> the timezone will now be set to UTC for
DSTAMP, TSTAMP and TODAY. This also applies to nested formats
where the locale now also defaults to en_US unless it (or the
timezone) have been set explicitly.
+ Upgraded the jakarta.mail dependency to 2.0.2 because of
bsc#1246873, CVE-2025-7962.
+ the SOURCE_DATE_EPOCH environment variable as well as the
magic ant.tstamp.now and ant.tstamp.now.iso properties now
also affect the timestamp added to a properties file written
by <propertyfile> - but only if jdkproperties has its default
value of false.
+ a new method getBuildDate in Project can now be used to
calculate a notion of a "build date" that consults the
SOURCE_DATE_EPOCH environment variable as well as the magic
ant.tstamp.now and ant.tstamp.now.iso properties in this order
which you can use if you want to obtain a reproducible
timestamp in tasks you write yourself.
+ The "record" task now has a new "relativeToBaseDir" attribute,
which can be set to "yes" or "no", to control where the
recorder's file gets created. In the absence of this
attribute, if the "name" of the recorder was a relative path,
then the recorder would create the file in the current working
directory of the process. With this new attribute, the
recorder can be configured to create that file in the basedir
of the project.
* Fixed bugs:
+ When running with "microsoft" Java, Ant used to hardcode the
"$JAVA_HOME/Packages" directory in the runtime Paths for
certain tasks. The JDK shipped by Microsoft no longer contains
that directory (for several decades now). As a result, when
running with "microsoft" Java, an exception would be raised
due to the missing directory. This has now been fixed and Ant
no longer adds that directory to the Java runtime Paths.
+ Inaccuracies in the documentation of the "record" task have
been fixed.
+ <mappedresources> with "enableMultipleMappings" set to "true"
threw a NullPointerException if the mapper didn't apply to
one of the resources. Unmapped resources are now omitted from
the collection.
- Changes of version 1.10.17
+ The JavaEnvUtils and FileUtils classes statically depend on
each other since Ant 1.10.16 making it impossible to load
JavaEnvUtils without loading FileUtils first causing
NullPointerException for programmatic use on Windows. This
affected Eclipse and may also affect other projects using Ant
as a library. The classes can now be loaded independently
again.
- Changes of version 1.10.16
+ <xslt> now uses the same logic to compare file timestamps when
determining whether a target file is out-of-date with respect
to the source file or stylesheet that most other tasks use.
This means it will assume a default timestamp granularity that
depends on the current operating system.
A new granularity attribute allows you to override the assumed
granularity.
Under certain edge cases this means xslt will now not process
files it would have processed before (when the timestamps of
source or stylesheet are very close or even equal to the
timestamp of the target). In this case you can set granularity
to 0 to get back to the behavior of 1.10.15.
+ the <mail> task as well as MailLogger will now check the server
identity as specified by RFC 2595 when JavaMail is used in
combination with TLS (plain TLS or StartTLS).
The check can be disabled with a new MailLogger property
MailLogger.tls.checkserveridentity or a new <mail> task
attribute checkServerIdentity.
+ Ant now recognizes Windows junctions and treats them just like
symbolic links in general. With this builds on Windows that
use followSymlinks="false" and rely on Ant following Windows
junctions will break. In order to get the old behavior you
need to set followSymlinks to true and exclude real symbolic
links via the <symlink> selector.
+ <scp> now properly handles IPv6 addresses as hostnames.
+ javac task has been fixed to generate the "-classpath" option
only when there are any classpath elements present.
+ URLResource#getName could strip the first character of a
resource path even if it was not a file separator.
+ ant.bat now exits with a non-zero exit code if ANT_HOME is not
set.
+ A regression in ftp task caused some files to not be
downloaded. That has been fixed now.
+ Ant will no longer set a java.lang.SecurityManager at runtime
if the "java.security.manager" system property is set to
"disallow".
+ <mail> and MailLogger can now enforce the use of STARTLS
rather than silently fall back to unencrypted authentication
via a new MailLogger property and a new <mail> task attribute.
+ added a Windows specific <mklink> task that can be used to
create hard links, symbolic links and junctions.
+ added <delete link="..."> that can be used delete symbolic
links or Windows junctions. For symbolic links this duplicates
what <symlink action="delete" ...> does - it has been
introduced to handle symlinks and junctions via a single API.
+ added <canCreateSymlink> condition that evaluates to true if
the current Ant process can create symbolic links.
+ added <windowsjunction> file selector which only selects
directories that are Windows junctions.
+ added a new actOnLinkTargets attribute to <setpermissions> to
control whether the permissions apply to a symbolic link or
Windows junction or the target of the respective links. The
old behavior of changing the link's target remains as default.
+ a new combination of attributes allows <sshexec> to mask
sensitive data specified for the command line to execute.
+ just omit completely the Created-By if SOURCE_DATE_EPOCH is
set
- <get> has a new attribute authenticateOnRedirect that can be
used to prevent Ant from sending the configured credentials
builds that rely on credentials being used on the redirected
- the PropertyEnumerator change introduced in 1.10.9 proved to
be not fully backwards compatible when combined with certain
- <scp> may leak connections when trying to preserve the last
modified timestamps of files transferred recursively from a
environment variable value to an incorrect date. This has now
- fetch.xml didn't set up non-default repositories propery and
build script would change permissions on unrelated files in
the destination directory. This is now fixed and such
unrelated files in the destination directory will be left
- parsing tar entries with multiple NUL bytes in their name
- loadresource might log warnings even though quiet was set to
repackaged Jakarta Mail package rather than javax Mail.
- org.apache.tools.ant.BuildLogger now has a new method
getMessageOutputLevel() which returns the currently set
CVE-2021-36374, bsc#1188469
Excessive memory allocation when reading a specially
* Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.
* The implementation of AntClassLoader#findResources() has been changed to optimize
- Update to ant 1.8.2
Patchnames: openSUSE-Leap-16.0-1718
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.5 (Medium)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Leap 16.0:ant-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-antlr-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-apache-bcel-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-apache-bsf-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-apache-log4j-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-apache-oro-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-apache-regexp-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-apache-resolver-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-apache-xalan2-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-commons-logging-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-commons-net-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-imageio-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-jakartamail-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-javamail-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-jdepend-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-jmf-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-jsch-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-junit-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-junit5-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-manual-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-scripts-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-swing-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-testutil-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 16.0:ant-xz-0:1.10.18-160000.1.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
24 products, the same list as for
CVE-2021-36374
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
24 products, the same list as for
CVE-2021-36374
Threats
Impact
important
References
14 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for ant",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for ant fixes the following issues:\n\n- CVE-2021-36374: excessive memory allocation when reading a specially crafted ZIP archive or a derived formats\n (bsc#1188469).\n- CVE-2025-7962: jakarta: improper neutralization of \\r and \\n UTF-8 characters can lead to SMTP injection\n (bsc#1246873).\n- CVE-2026-78254: path traversal in ftp and scp tasks allows for arbitrary file writes (bsc#1280015).\n\nChanges for ant:\n\n- Upgrade to version 1.10.18\n * Breaking changes:\n + the default value for \u003cftp\u003e\u0027s useSecureDataChannel has been\n changed to true which means using ftps now also tries to use\n an encrypted data channel by default.\n + the \u003cftp\u003e and \u003cscp\u003e tasks have new allowFilesToEscapeDest\n attributes. When set to false - which is the default - the\n tasks will not download files or create directories outside\n the designated destination directory when downloading from the\n remote server. In the unlikely case you need the old bahaviour\n of writing outside the destination directory you must set the\n value to true explicitly.\n * Other changes:\n + when using the SOURCE_DATE_EPOCH environment variable to set\n the time for \u003ctstamp\u003e the timezone will now be set to UTC for\n DSTAMP, TSTAMP and TODAY. This also applies to nested formats\n where the locale now also defaults to en_US unless it (or the\n timezone) have been set explicitly.\n + Upgraded the jakarta.mail dependency to 2.0.2 because of\n bsc#1246873, CVE-2025-7962.\n + the SOURCE_DATE_EPOCH environment variable as well as the\n magic ant.tstamp.now and ant.tstamp.now.iso properties now\n also affect the timestamp added to a properties file written\n by \u003cpropertyfile\u003e - but only if jdkproperties has its default\n value of false.\n + a new method getBuildDate in Project can now be used to\n calculate a notion of a \"build date\" that consults the\n SOURCE_DATE_EPOCH environment variable as well as the magic\n ant.tstamp.now and ant.tstamp.now.iso properties in this order\n which you can use if you want to obtain a reproducible\n timestamp in tasks you write yourself.\n + The \"record\" task now has a new \"relativeToBaseDir\" attribute,\n which can be set to \"yes\" or \"no\", to control where the\n recorder\u0027s file gets created. In the absence of this\n attribute, if the \"name\" of the recorder was a relative path,\n then the recorder would create the file in the current working\n directory of the process. With this new attribute, the\n recorder can be configured to create that file in the basedir\n of the project.\n * Fixed bugs:\n + When running with \"microsoft\" Java, Ant used to hardcode the\n \"$JAVA_HOME/Packages\" directory in the runtime Paths for\n certain tasks. The JDK shipped by Microsoft no longer contains\n that directory (for several decades now). As a result, when\n running with \"microsoft\" Java, an exception would be raised\n due to the missing directory. This has now been fixed and Ant\n no longer adds that directory to the Java runtime Paths.\n + Inaccuracies in the documentation of the \"record\" task have\n been fixed.\n + \u003cmappedresources\u003e with \"enableMultipleMappings\" set to \"true\"\n threw a NullPointerException if the mapper didn\u0027t apply to\n one of the resources. Unmapped resources are now omitted from\n the collection.\n- Changes of version 1.10.17\n + The JavaEnvUtils and FileUtils classes statically depend on\n each other since Ant 1.10.16 making it impossible to load\n JavaEnvUtils without loading FileUtils first causing\n NullPointerException for programmatic use on Windows. This\n affected Eclipse and may also affect other projects using Ant\n as a library. The classes can now be loaded independently\n again.\n- Changes of version 1.10.16\n + \u003cxslt\u003e now uses the same logic to compare file timestamps when\n determining whether a target file is out-of-date with respect\n to the source file or stylesheet that most other tasks use.\n This means it will assume a default timestamp granularity that\n depends on the current operating system.\n A new granularity attribute allows you to override the assumed\n granularity.\n Under certain edge cases this means xslt will now not process\n files it would have processed before (when the timestamps of\n source or stylesheet are very close or even equal to the\n timestamp of the target). In this case you can set granularity\n to 0 to get back to the behavior of 1.10.15.\n + the \u003cmail\u003e task as well as MailLogger will now check the server\n identity as specified by RFC 2595 when JavaMail is used in\n combination with TLS (plain TLS or StartTLS).\n The check can be disabled with a new MailLogger property\n MailLogger.tls.checkserveridentity or a new \u003cmail\u003e task\n attribute checkServerIdentity.\n + Ant now recognizes Windows junctions and treats them just like\n symbolic links in general. With this builds on Windows that\n use followSymlinks=\"false\" and rely on Ant following Windows\n junctions will break. In order to get the old behavior you\n need to set followSymlinks to true and exclude real symbolic\n links via the \u003csymlink\u003e selector.\n + \u003cscp\u003e now properly handles IPv6 addresses as hostnames.\n + javac task has been fixed to generate the \"-classpath\" option\n only when there are any classpath elements present.\n + URLResource#getName could strip the first character of a\n resource path even if it was not a file separator.\n + ant.bat now exits with a non-zero exit code if ANT_HOME is not\n set.\n + A regression in ftp task caused some files to not be\n downloaded. That has been fixed now.\n + Ant will no longer set a java.lang.SecurityManager at runtime\n if the \"java.security.manager\" system property is set to\n \"disallow\".\n + \u003cmail\u003e and MailLogger can now enforce the use of STARTLS\n rather than silently fall back to unencrypted authentication\n via a new MailLogger property and a new \u003cmail\u003e task attribute.\n + added a Windows specific \u003cmklink\u003e task that can be used to\n create hard links, symbolic links and junctions.\n + added \u003cdelete link=\"...\"\u003e that can be used delete symbolic\n links or Windows junctions. For symbolic links this duplicates\n what \u003csymlink action=\"delete\" ...\u003e does - it has been\n introduced to handle symlinks and junctions via a single API.\n + added \u003ccanCreateSymlink\u003e condition that evaluates to true if\n the current Ant process can create symbolic links.\n + added \u003cwindowsjunction\u003e file selector which only selects\n directories that are Windows junctions.\n + added a new actOnLinkTargets attribute to \u003csetpermissions\u003e to\n control whether the permissions apply to a symbolic link or\n Windows junction or the target of the respective links. The\n old behavior of changing the link\u0027s target remains as default.\n + a new combination of attributes allows \u003csshexec\u003e to mask\n sensitive data specified for the command line to execute.\n + just omit completely the Created-By if SOURCE_DATE_EPOCH is\n set\n - \u003cget\u003e has a new attribute authenticateOnRedirect that can be\n used to prevent Ant from sending the configured credentials\n builds that rely on credentials being used on the redirected\n - the PropertyEnumerator change introduced in 1.10.9 proved to\n be not fully backwards compatible when combined with certain\n - \u003cscp\u003e may leak connections when trying to preserve the last\n modified timestamps of files transferred recursively from a\n environment variable value to an incorrect date. This has now\n - fetch.xml didn\u0027t set up non-default repositories propery and\n build script would change permissions on unrelated files in\n the destination directory. This is now fixed and such\n unrelated files in the destination directory will be left\n - parsing tar entries with multiple NUL bytes in their name\n - loadresource might log warnings even though quiet was set to\n repackaged Jakarta Mail package rather than javax Mail.\n - org.apache.tools.ant.BuildLogger now has a new method\n getMessageOutputLevel() which returns the currently set\n CVE-2021-36374, bsc#1188469\n Excessive memory allocation when reading a specially\n * Prevent potential deadlocks in org.apache.tools.ant.IntrospectionHelper.\n * The implementation of AntClassLoader#findResources() has been changed to optimize\n- Update to ant 1.8.2\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-1718",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21891-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1188469",
"url": "https://bugzilla.suse.com/1188469"
},
{
"category": "self",
"summary": "SUSE Bug 1246873",
"url": "https://bugzilla.suse.com/1246873"
},
{
"category": "self",
"summary": "SUSE Bug 1280015",
"url": "https://bugzilla.suse.com/1280015"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2021-36374 page",
"url": "https://www.suse.com/security/cve/CVE-2021-36374/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-7962 page",
"url": "https://www.suse.com/security/cve/CVE-2025-7962/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-78254 page",
"url": "https://www.suse.com/security/cve/CVE-2026-78254/"
}
],
"title": "Security update for ant",
"tracking": {
"current_release_date": "2026-09-24T17:48:08Z",
"generator": {
"date": "2026-09-20T14:11:16Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:21891-1",
"initial_release_date": "2026-09-20T14:11:16Z",
"revision_history": [
{
"date": "2026-09-20T14:11:16Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-24T17:48:08Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "ant-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-antlr-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-antlr-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-antlr-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-antlr@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-apache-bcel-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-apache-bcel-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-apache-bcel-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-apache-bcel@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-apache-bsf-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-apache-bsf-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-apache-bsf-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-apache-bsf@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-apache-log4j-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-apache-log4j-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-apache-log4j-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-apache-log4j@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-apache-oro-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-apache-oro-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-apache-oro-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-apache-oro@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-apache-regexp-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-apache-regexp-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-apache-regexp-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-apache-regexp@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-apache-resolver-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-apache-resolver-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-apache-resolver-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-apache-resolver@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-apache-xalan2-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-apache-xalan2-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-apache-xalan2-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-apache-xalan2@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-commons-logging-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-commons-logging-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-commons-logging-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-commons-logging@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-commons-net-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-commons-net-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-commons-net-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-commons-net@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-imageio-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-imageio-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-imageio-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-imageio@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-jakartamail-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-jakartamail-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-jakartamail-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-jakartamail@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-javamail-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-javamail-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-javamail-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-javamail@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-jdepend-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-jdepend-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-jdepend-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-jdepend@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-jmf-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-jmf-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-jmf-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-jmf@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-jsch-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-jsch-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-jsch-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-jsch@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-junit-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-junit-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-junit-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-junit@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-junit5-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-junit5-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-junit5-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-junit5@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-manual-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-manual-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-manual-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-manual@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-scripts-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-scripts-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-scripts-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-scripts@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-swing-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-swing-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-swing-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-swing@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-testutil-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-testutil-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-testutil-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-testutil@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
},
{
"category": "product_version",
"name": "ant-xz-0:1.10.18-160000.1.1.noarch",
"product": {
"name": "ant-xz-0:1.10.18-160000.1.1.noarch",
"product_id": "ant-xz-0:1.10.18-160000.1.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:apache:ant:1.10.18:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ant-xz@1.10.18-160000.1.1?arch=noarch\u0026upstream=ant-0:1.10.18-160000.1.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-antlr-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-antlr-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-antlr-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-apache-bcel-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-apache-bcel-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-apache-bcel-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-apache-bsf-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-apache-bsf-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-apache-bsf-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-apache-log4j-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-apache-log4j-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-apache-log4j-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-apache-oro-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-apache-oro-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-apache-oro-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-apache-regexp-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-apache-regexp-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-apache-regexp-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-apache-resolver-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-apache-resolver-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-apache-resolver-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-apache-xalan2-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-apache-xalan2-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-apache-xalan2-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-commons-logging-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-commons-logging-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-commons-logging-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-commons-net-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-commons-net-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-commons-net-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-imageio-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-imageio-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-imageio-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-jakartamail-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-jakartamail-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-jakartamail-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-javamail-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-javamail-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-javamail-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-jdepend-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-jdepend-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-jdepend-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-jmf-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-jmf-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-jmf-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-jsch-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-jsch-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-jsch-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-junit-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-junit-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-junit-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-junit5-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-junit5-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-junit5-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-manual-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-manual-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-manual-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-scripts-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-scripts-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-scripts-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-swing-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-swing-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-swing-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-testutil-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-testutil-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-testutil-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ant-xz-0:1.10.18-160000.1.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:ant-xz-0:1.10.18-160000.1.1.noarch"
},
"product_reference": "ant-xz-0:1.10.18-160000.1.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-36374",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2021-36374"
}
],
"notes": [
{
"category": "general",
"text": "When reading a specially crafted ZIP archive, or a derived formats, an Apache Ant build can be made to allocate large amounts of memory that leads to an out of memory error, even for small inputs. This can be used to disrupt builds using Apache Ant. Commonly used derived formats from ZIP archives are for instance JAR files and many office files. Apache Ant prior to 1.9.16 and 1.10.11 were affected.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:ant-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-antlr-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bcel-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bsf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-log4j-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-oro-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-regexp-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-resolver-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-xalan2-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-logging-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-net-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-imageio-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jakartamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-javamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jdepend-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jmf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jsch-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit5-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-manual-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-scripts-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-swing-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-testutil-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-xz-0:1.10.18-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2021-36374",
"url": "https://www.suse.com/security/cve/CVE-2021-36374"
},
{
"category": "external",
"summary": "SUSE Bug 1188469 for CVE-2021-36374",
"url": "https://bugzilla.suse.com/1188469"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:ant-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-antlr-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bcel-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bsf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-log4j-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-oro-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-regexp-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-resolver-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-xalan2-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-logging-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-net-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-imageio-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jakartamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-javamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jdepend-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jmf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jsch-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit5-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-manual-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-scripts-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-swing-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-testutil-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-xz-0:1.10.18-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:ant-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-antlr-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bcel-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bsf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-log4j-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-oro-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-regexp-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-resolver-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-xalan2-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-logging-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-net-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-imageio-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jakartamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-javamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jdepend-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jmf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jsch-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit5-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-manual-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-scripts-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-swing-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-testutil-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-xz-0:1.10.18-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-20T14:11:16Z",
"details": "moderate"
}
],
"title": "CVE-2021-36374"
},
{
"cve": "CVE-2025-7962",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-7962"
}
],
"notes": [
{
"category": "general",
"text": "In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \\r and \\n UTF-8 characters to separate different messages.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:ant-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-antlr-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bcel-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bsf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-log4j-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-oro-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-regexp-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-resolver-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-xalan2-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-logging-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-net-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-imageio-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jakartamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-javamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jdepend-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jmf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jsch-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit5-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-manual-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-scripts-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-swing-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-testutil-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-xz-0:1.10.18-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-7962",
"url": "https://www.suse.com/security/cve/CVE-2025-7962"
},
{
"category": "external",
"summary": "SUSE Bug 1246873 for CVE-2025-7962",
"url": "https://bugzilla.suse.com/1246873"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:ant-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-antlr-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bcel-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bsf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-log4j-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-oro-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-regexp-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-resolver-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-xalan2-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-logging-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-net-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-imageio-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jakartamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-javamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jdepend-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jmf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jsch-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit5-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-manual-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-scripts-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-swing-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-testutil-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-xz-0:1.10.18-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:ant-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-antlr-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bcel-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bsf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-log4j-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-oro-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-regexp-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-resolver-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-xalan2-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-logging-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-net-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-imageio-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jakartamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-javamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jdepend-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jmf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jsch-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit5-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-manual-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-scripts-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-swing-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-testutil-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-xz-0:1.10.18-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-20T14:11:16Z",
"details": "moderate"
}
],
"title": "CVE-2025-7962"
},
{
"cve": "CVE-2026-78254",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-78254"
}
],
"notes": [
{
"category": "general",
"text": "The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to write outside of the dedicated target directory for the download, making it possible to overwrite files of the attacker\u0027s choice using the permissions of the user running Ant in versions prior to Ant 1.10.18. \n\n\n\n\nIn order to exploit this vulnerability, the server would either have to be malicious or be subject to a machine-in-the-middle attack. Additionally in the case of scp or the ftp task using ftps the server must pass the server identity checks performed by the tasks.\n\n\n\n\nFor ftp tasks not using ftps a malicious server could act as a machine-in-the-middle to provide malicious files.\n\n\n\n\nStarting with Ant 1.10.18 both tasks will prevent writing outside of the destination directory by default. An option is available to disable this behavior in the unlikely case that the old behavior is required by existing build files.\n\n\n\n\nMitigations:\n\n\n\n\nUsers of scp and ftp (when using ftps) in any version of Ant should not bypass server identity checks. Users of ftp not using ftps should switch to ftps where possible.\n\n\n\n\nAll users are recommended to upgrade to Apache Ant 1.10.18, which fixes this issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:ant-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-antlr-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bcel-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bsf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-log4j-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-oro-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-regexp-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-resolver-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-xalan2-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-logging-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-net-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-imageio-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jakartamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-javamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jdepend-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jmf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jsch-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit5-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-manual-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-scripts-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-swing-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-testutil-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-xz-0:1.10.18-160000.1.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-78254",
"url": "https://www.suse.com/security/cve/CVE-2026-78254"
},
{
"category": "external",
"summary": "SUSE Bug 1280015 for CVE-2026-78254",
"url": "https://bugzilla.suse.com/1280015"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:ant-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-antlr-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bcel-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bsf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-log4j-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-oro-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-regexp-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-resolver-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-xalan2-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-logging-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-net-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-imageio-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jakartamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-javamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jdepend-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jmf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jsch-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit5-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-manual-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-scripts-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-swing-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-testutil-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-xz-0:1.10.18-160000.1.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:ant-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-antlr-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bcel-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-bsf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-log4j-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-oro-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-regexp-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-resolver-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-apache-xalan2-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-logging-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-commons-net-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-imageio-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jakartamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-javamail-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jdepend-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jmf-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-jsch-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-junit5-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-manual-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-scripts-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-swing-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-testutil-0:1.10.18-160000.1.1.noarch",
"openSUSE Leap 16.0:ant-xz-0:1.10.18-160000.1.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-09-20T14:11:16Z",
"details": "important"
}
],
"title": "CVE-2026-78254"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…