GCVE - cpe:2.3:a:reproducible_builds:diffoscope:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:reproducible_builds:diffoscope:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Reproducible Builds (`6f3cde64-83d2-517b-a6ad-7e55396af714`)
Product	Diffoscope (`1b35c76a-94db-516b-9184-d1fbd3f965ab`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL	Source	Last updated
`pkg:deb/debian/diffoscope`	purl2cpe	2026-06-01 10:16:39.334563
`pkg:deb/ubuntu/diffoscope`	purl2cpe	2026-06-01 10:16:39.334565
`pkg:docker/tianon/diffoscope`	purl2cpe	2026-06-01 10:16:39.334567
`pkg:github/prototypefund/reproducible-builds-diffoscope-website`	purl2cpe	2026-06-01 10:16:39.334568
`pkg:pypi/diffoscope`	purl2cpe	2026-06-01 10:16:39.334570
`pkg:rpm/fedora/diffoscope`	purl2cpe	2026-06-01 10:16:39.334571
`pkg:rpm/opensuse/diffoscope`	purl2cpe	2026-06-01 10:16:39.334573

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-25711`	vulnerable	2026-06-08 06:31:23.774813	Details available diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted. Published: 2024-02-11T00:00:00.000Z Updated: 2025-11-04T18:29:37.954Z Open on db.gcve.eu Reference links https://salsa.debian.org/reproducible-builds/diffoscope/-/issues/361 https://salsa.debian.org/reproducible-builds/diffoscope/-/commit/dfed769904c27d66a14a5903823d9c8c5aae860e https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OUNBANAWD6TZH2NRRV4YUIAXEHLUJQ47/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-0359`	vulnerable	2026-06-08 05:08:25.977525	diffoscope writes to arbitrary locations on disk based on the contents of an untrusted archive diffoscope before 77 writes to arbitrary locations on disk based on the contents of an untrusted archive. Published: 2018-04-13T16:00:00.000Z Updated: 2024-09-16T17:38:23.607Z Open on db.gcve.eu Reference links https://bugs.debian.org/854723 https://security-tracker.debian.org/tracker/CVE-2017-0359	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.