Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-79675 →

DEBIAN-CVE-2026-79675

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject da...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 nltk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 nltk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 nltk

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-1"}]}]

Références

advisory security-tracker.debian.org