diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archive
Priority MEDIUM 46CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive.
Why it matters now
EPSS 0.02245 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed diffoscope (Debian): 77diffoscope (PyPI): 76
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Debian | diffoscope | before 77 | 77 | Patch available | CNA |
| — | diffoscope (PyPI) | before 76 | 76 | Patch available | GHSA-8p5c-f328-9fvv |
- diffoscope VendorDebian Affected before 77 Fixed in 77 Patch available CNA
- diffoscope (PyPI) Vendor— Affected before 76 Fixed in 76 Patch available GHSA-8p5c-f328-9fvv
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:reproducible_builds:diffoscope:*:*:*:*:*:*:*:* | before 77 | Vulnerable | Reproducible Builds |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:reproducible_builds:diffoscope:*:*:*:*:*:*:*:* Versions before 77 Vulnerable ·Reproducible Builds
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
- Fix · CNA diffoscope (Debian) Fixed in 77
- Fix · GHSA-8p5c-f328-9fvv diffoscope (PyPI) Fixed in 76 Advisory →
Vendor assessments
Timeline
- 2026-10-02 Threatist record created from CVE-2017-0359
- 2026-10-03 Alias added: GHSA-8p5c-f328-9fvv
References
Exploit 1
Advisory 3
Other 5
- https://github.com/anthraxx/diffoscope/commit/632a40828a54b399787c25e7fa243f732aef7e05
- https://github.com/anthraxx/diffoscope/commit/f379d1f611dbd5d361e12b732e07c8aee45ff226
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=854723
- https://github.com/anthraxx/diffoscope
- https://github.com/pypa/advisory-database/tree/main/vulns/diffoscope/PYSEC-2018-83.yaml
More Debian Linux vulnerabilities
- TI-2026-19388 telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root"… KEVCVSS 3.1CRITICAL 9.8
- TI-2025-31204 Deserialization of untrusted data in Roundcube Webmail KEVCVSS 3.1CRITICAL 9.9
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2025-23504 Erlang/OTP SSH Vulnerable to Pre-Authentication RCE KEVCVSS 3.1CRITICAL 10.0
- TI-2025-18529 Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT KEVCVSS 3.1CRITICAL 10.0
- TI-2025-17951 Out-of-bounds write in Apple Safari KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2017-0359 · CVE Program
- CVE-2017-0359 · NVD
- FIRST EPSS
- GHSA-8p5c-f328-9fvv · GitHub Advisory Database · CC BY 4.0
- CVE-2017-0359 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences