DEBIAN-CVE-2026-91142
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-91142
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-91142.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-91142
- Upstream
- CVE-2026-91142
- Published
- 2026-09-18T17:17:05Z
- Modified
- 2026-09-19T07:00:10Z
- Severity
-
- 3.6 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in Cockpit. An integer overflow vulnerability in the
do_lastlog()function, specifically in the offset calculation forlastlogentries on ILP32 (Integer, Long, Pointer 32-bit) builds, can be exploited. A low-privileged authenticated user with a specially provisioned large User ID (UID) can cause the computed offset to wrap around. This allows the user to perform unauthorized reads and writes to other users'lastlogrecords, potentially disclosing or altering sensitive login accounting information. - References
Affected packages
Debian:12 / cockpit
Package
- Name
- cockpit
- Purl
- pkg:deb/debian/cockpit?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
Other
287-1
289-1
290-1
291-1
292-1
293-1
294-1
295-1
296-1
297-1~bpo12+1
297-1
298-1
299-1~bpo12+1
299-1
300-1
301-1~bpo12+1
301-1
302-1
303-1~bpo12+1
303-1
304-1
305-1~bpo12+1
305-1
306-1~bpo12+1
306-1
307-1~bpo12+1
307-1
308-1~bpo12+1
308-1
309-1~bpo12+1
309-1
310-1
311-1~bpo12+1
311-1
312-1
313-1
314-1
316-1
317-1
317-2
317-3
317-4
317-5
318-1
318-2
318-3
318-4~bpo12+1
318-4
319-1~bpo12+1
319-1
320-1~bpo12+1
320-1
321-1
322-1~bpo12+1
322-1
323-1~bpo12+1
323-1
324-1~bpo12+1
324-1
325-1~bpo12+1
325-1
326-1
327-1~bpo12+1
327-1
328-1
329-1~bpo12+1
329-1
330-1
330-2
330-3
330-4
331-1~bpo12+1
331-1
332-1
333-1~bpo12+1
333-1
334-1
335-1
335-2~bpo12+1
335-2
336-1
337-1~bpo12+1
337-1
338-1
339-1
340-1
342-1
343-1
345-1~bpo13+1
345-1
346-1~bpo13+1
346-1
348-1~bpo13+1
348-1
350-1~bpo13+1
350-1
352-1~bpo13+1
352-1
354-1~bpo13+1
354-1
355-1~bpo13+1
355-1
356-1~bpo13+1
356-1
358-1~bpo13+1
358-1
360-1~bpo13+1
360-1
362-1~bpo13+1
362-1
365-1~bpo13+1
365-1
366-1~bpo13+1
366-1
367-1~bpo13+1
367-1
287.*
287.1-0+deb12u1
287.1-0+deb12u2
287.1-0+deb12u3
288.*
288.1-1
294.*
294.1-1
300.*
300.1-1~bpo12+1
300.1-1
310.*
310.1-1~bpo12+1
310.1-1
341.*
341.1-1
353.*
353.1-1~bpo13+1
353.1-1
Debian:13 / cockpit
Package
- Name
- cockpit
- Purl
- pkg:deb/debian/cockpit?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
Other
337-1
337-1+deb13u1
337-1+deb13u2
338-1
339-1
340-1
342-1
343-1
345-1~bpo13+1
345-1
346-1~bpo13+1
346-1
348-1~bpo13+1
348-1
350-1~bpo13+1
350-1
352-1~bpo13+1
352-1
354-1~bpo13+1
354-1
355-1~bpo13+1
355-1
356-1~bpo13+1
356-1
358-1~bpo13+1
358-1
360-1~bpo13+1
360-1
362-1~bpo13+1
362-1
365-1~bpo13+1
365-1
366-1~bpo13+1
366-1
367-1~bpo13+1
367-1
341.*
341.1-1
353.*
353.1-1~bpo13+1
353.1-1
Debian:14 / cockpit
Package
- Name
- cockpit
- Purl
- pkg:deb/debian/cockpit?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
Other
337-1
338-1
339-1
340-1
342-1
343-1
345-1~bpo13+1
345-1
346-1~bpo13+1
346-1
348-1~bpo13+1
348-1
350-1~bpo13+1
350-1
352-1~bpo13+1
352-1
354-1~bpo13+1
354-1
355-1~bpo13+1
355-1
356-1~bpo13+1
356-1
358-1~bpo13+1
358-1
360-1~bpo13+1
360-1
362-1~bpo13+1
362-1
365-1~bpo13+1
365-1
366-1~bpo13+1
366-1
367-1~bpo13+1
367-1
341.*
341.1-1
353.*
353.1-1~bpo13+1
353.1-1