{
  "document": {
    "aggregate_severity": {
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      },
      {
        "category": "details",
        "text": "* SECURITY UPDATE: out-of-bounds read via a positional field width or\n     precision in printf/sprintf\n     - debian/patches/CVE-2023-4156.patch: reject a negative positional index\n       in format_tree() in builtin.c. The digit run of a `%*N$' specifier is\n       accumulated into an int, so a sufficiently long N wraps it negative;\n       the existing guard tested only val >= num_args, letting the negative\n       value reach the_args[val] and read before the start of the argument\n       array\n     - CVE-2023-4156\n   * SECURITY UPDATE: use-after-free in getline from a two-way pipe\n     - debian/patches/CVE-2026-40467.patch: stop do_getline_redir() in io.c\n       from releasing redir_exp immediately after redirect(), since the\n       two-way-pipe error path still reads redir_exp->stptr/stlen through\n       is_non_fatal_redirect(). The DEREF is moved to each control-flow path\n       after the node's last use\n     - CVE-2026-40467\n   * SECURITY UPDATE: heap buffer overflow in sub()/gsub() on 32-bit\n     architectures\n     - debian/patches/CVE-2026-40468.patch: widen the sofar accumulator in\n       do_sub() in builtin.c from int to size_t so the running offset into the\n       replacement buffer cannot overflow while the buffer itself is sized\n       with size_t arithmetic. The upstream commit's second hunk, widening i\n       to int64_t in parse_escape() in node.c, is carried verbatim for\n       fidelity; it is inert here, as that function's octal and hex loops are\n       bounded at 0777 and 0xFF and it returns int\n     - CVE-2026-40468\n   * SECURITY UPDATE: integer overflow in the sub()/gsub() replacement size\n     computation on 32-bit architectures\n     - debian/patches/CVE-2026-40469.patch: compute the ampersand expansion in\n       do_sub() in builtin.c as a uint64_t and fatal out with \"replacement\n       expansion too large\" when the result would exceed SIZE_MAX, instead of\n       wrapping and under-allocating the destination buffer\n     - CVE-2026-40469\n   * SECURITY UPDATE: stack buffer overflow in the readdir extension\n     - debian/patches/CVE-2026-40553.patch: build the path in ftype() in\n       extension/readdir.c with a bounded snprintf() and reject the entry when\n       the result would be truncated, replacing the unbounded strcpy()/strcat()\n       pair that overflowed fname[] for a sufficiently long directory or entry\n       name\n     - CVE-2026-40553",
        "title": "Details"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789390312",
        "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789390312"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/debian11els/advisories/2026/clsa-2026_1789390312.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-09-14T12:53:14Z",
      "generator": {
        "date": "2026-09-14T12:53:14Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CLSA-2026:1789390312",
      "initial_release_date": "2026-09-14T12:53:14Z",
      "revision_history": [
        {
          "date": "2026-09-14T12:53:14Z",
          "number": "1",
          "summary": "Initial version"
        }
      ],
      "status": "final",
      "version": "1"
    },
    "title": "Fix of 5 CVEs"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Debian 11",
                "product": {
                  "name": "Debian 11",
                  "product_id": "Debian-11",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:debian:debian_linux:11:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Debian"
          }
        ],
        "category": "vendor",
        "name": "Software in the Public Interest, Inc."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gawk-1:5.1.0-1+tuxcare.els1.arm64",
                "product": {
                  "name": "gawk-1:5.1.0-1+tuxcare.els1.arm64",
                  "product_id": "gawk-1:5.1.0-1+tuxcare.els1.arm64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/gawk@1:5.1.0-1%2Btuxcare.els1?arch=arm64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gawk-1:5.1.0-1+tuxcare.els1.armel",
                "product": {
                  "name": "gawk-1:5.1.0-1+tuxcare.els1.armel",
                  "product_id": "gawk-1:5.1.0-1+tuxcare.els1.armel",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/gawk@1:5.1.0-1%2Btuxcare.els1?arch=armel"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "armel"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "gawk-1:5.1.0-1+tuxcare.els1.amd64",
                "product": {
                  "name": "gawk-1:5.1.0-1+tuxcare.els1.amd64",
                  "product_id": "gawk-1:5.1.0-1+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/tuxcare/gawk@1:5.1.0-1%2Btuxcare.els1?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "TuxCare"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gawk-1:5.1.0-1+tuxcare.els1.arm64 as a component of Debian 11",
          "product_id": "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.arm64"
        },
        "product_reference": "gawk-1:5.1.0-1+tuxcare.els1.arm64",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gawk-1:5.1.0-1+tuxcare.els1.armel as a component of Debian 11",
          "product_id": "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.armel"
        },
        "product_reference": "gawk-1:5.1.0-1+tuxcare.els1.armel",
        "relates_to_product_reference": "Debian-11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "gawk-1:5.1.0-1+tuxcare.els1.amd64 as a component of Debian 11",
          "product_id": "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.amd64"
        },
        "product_reference": "gawk-1:5.1.0-1+tuxcare.els1.amd64",
        "relates_to_product_reference": "Debian-11"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-40469",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "Integer overflow vulnerability has been found in \"builtin.c\" program file of gawk (do_sub() routine). This issue could be used to overwrite gawk heap metadata and objects causing the program to crash. It affects 32-bit builds of gawk in versions 5.4.0 and below.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.amd64",
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.arm64",
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.armel"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-40469"
        },
        {
          "category": "external",
          "summary": "https://cert.pl/en/posts/2026/07/CVE-2026-40467",
          "url": "https://cert.pl/en/posts/2026/07/CVE-2026-40467"
        },
        {
          "category": "external",
          "summary": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=ae1b2d508f46913269a9e62aceda3636afe8147b",
          "url": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=ae1b2d508f46913269a9e62aceda3636afe8147b"
        }
      ],
      "release_date": "2026-07-13T13:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-14T12:51:55.427096Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789390312",
          "product_ids": [
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.amd64",
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.arm64",
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789390312"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ]
    },
    {
      "cve": "CVE-2026-40467",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "notes": [
        {
          "category": "description",
          "text": "Use After Free vulnerability has been found in \"io.c\" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.amd64",
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.arm64",
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.armel"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-40467"
        },
        {
          "category": "external",
          "summary": "https://cert.pl/en/posts/2026/07/CVE-2026-40467",
          "url": "https://cert.pl/en/posts/2026/07/CVE-2026-40467"
        },
        {
          "category": "external",
          "summary": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8",
          "url": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=a2d18c74109e41bec29a23098eba2e00057286d8"
        }
      ],
      "release_date": "2026-07-13T13:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-14T12:51:55.427096Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789390312",
          "product_ids": [
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.amd64",
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.arm64",
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789390312"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    },
    {
      "cve": "CVE-2026-40468",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "Integer overflow vulnerability has been found in \"builtin.c\" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.amd64",
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.arm64",
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.armel"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-40468"
        },
        {
          "category": "external",
          "summary": "https://cert.pl/en/posts/2026/07/CVE-2026-40467",
          "url": "https://cert.pl/en/posts/2026/07/CVE-2026-40467"
        },
        {
          "category": "external",
          "summary": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7",
          "url": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=062f2f2581b991362c046f7f2e238ffa34e6f8c7"
        }
      ],
      "release_date": "2026-07-13T13:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-14T12:51:55.427096Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789390312",
          "product_ids": [
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.amd64",
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.arm64",
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789390312"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Critical"
        }
      ]
    },
    {
      "cve": "CVE-2026-40553",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "Buffer overflow vulnerability has been found in \"extension/readdir.c\" program file of gawk (ftype() routine). This issue could be used to crash the program and potentially to achieve code execution, although the latter has not been confirmed to be feasible. It affects gawk in versions 5.4.0 and below.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.amd64",
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.arm64",
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.armel"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2026-40553"
        },
        {
          "category": "external",
          "summary": "https://cert.pl/en/posts/2026/07/CVE-2026-40467",
          "url": "https://cert.pl/en/posts/2026/07/CVE-2026-40467"
        },
        {
          "category": "external",
          "summary": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=cca0366144336b49aaa7d5d949966ce8e2c70843",
          "url": "https://cgit.git.savannah.gnu.org/cgit/gawk.git/commit/?id=cca0366144336b49aaa7d5d949966ce8e2c70843"
        }
      ],
      "release_date": "2026-07-13T13:16:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-14T12:51:55.427096Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789390312",
          "product_ids": [
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.amd64",
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.arm64",
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789390312"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    },
    {
      "cve": "CVE-2023-4156",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "description",
          "text": "A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "fixed": [
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.amd64",
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.arm64",
          "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.armel"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2023-4156"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2023-4156",
          "url": "https://access.redhat.com/security/cve/CVE-2023-4156"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2215930",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2215930"
        }
      ],
      "release_date": "2023-09-25T18:15:00Z",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-09-14T12:51:55.427096Z",
          "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1789390312",
          "product_ids": [
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.amd64",
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.arm64",
            "Debian-11:gawk-1:5.1.0-1+tuxcare.els1.armel"
          ],
          "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1789390312"
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ]
    }
  ]
}