Tuxcare Errata System 0.0.1 5.10 2026-08-10T09:34:28 Debian 11 * SECURITY UPDATE: REXML ReDoS via leading-zero hex character reference - debian/patches/CVE-2024-49761.patch: replace the /&#0*((?:\d+)|(?:x[a-fA-F0-9]+));/ regex in unnormalize() with /&#((?:\d+)|(?:x[a-fA-F0-9]+));/ so that &#0x...; is no longer accepted as a hex character reference, eliminating the catastrophic-backtracking ReDoS on inputs with many leading zeros. - CVE-2024-49761 * SECURITY UPDATE: REXML DoS via deep same-local-name attributes - debian/patches/CVE-2024-43398.patch: replace the per-attribute tree-walk in Element#[]= with an O(1) parse-time conflict check using a parser-level @namespaces hash and an expanded_names hash keyed on [uri, local_part]; seed @namespaces with the implicitly-bound xml prefix per upstream 78f8712 to avoid breaking XHTML documents that use both xml:lang and lang. - CVE-2024-43398 * SECURITY UPDATE: REXML DoS via entity expansion in SAX/pull parsers - debian/patches/CVE-2024-41946.patch: route the SAX2Parser :text handler through @parser.unnormalize (upstream prerequisite 4ebf21f), and add @entity_expansion_count + per-call sum/Security.entity_expansion_text_limit accounting in BaseParser so that billion-laughs-style XML triggers "entity expansion has grown too large" / "number of entity expansions exceeded" in SAX and pull mode, matching the existing DOM behaviour. - CVE-2024-41946 * SECURITY UPDATE: REXML DoS via slow processing-instruction parsing - debian/patches/CVE-2024-41123.patch: rewrite process_instruction to call parse_name and then match the content separately, avoiding the catastrophic-backtracking INSTRUCTION_PATTERN regex; grow the IOSource read buffer exponentially via min_bytes so that source.match() is O(log n) attempts rather than O(n) on inputs that never match the regex. - CVE-2024-41123 Important TuxCare License Agreement CVE-2024-49761 CVE-2024-43398 CVE-2024-41946 CVE-2024-41123 Debian 11 * SECURITY UPDATE: Bundler argument injection via leading-dash Gemfile git URL - debian/patches/CVE-2021-43809.patch: insert "--" end-of-options separator before configured_uri in the clone and fetch commands built by lib/bundler/source/git/git_proxy.rb (the override .txz ships Bundler 2.2.24, predating the fix in 2.2.33). The clone command also reorders args so all flags precede "--", matching the upstream PR #5142 idiom. - CVE-2021-43809 Important TuxCare License Agreement CVE-2021-43809 CVE-2024-49761 CVE-2024-43398 CVE-2024-41946 CVE-2024-41123 Debian 11 * SECURITY UPDATE: REXML DoS via attribute value with many '>' characters - debian/patches/CVE-2024-35176.patch: replace the per-'>'-chunk re-read loop in parse_attributes with a single-pass read of the attribute value up to the closing quote followed by a read up to the actual tag end, so that an attribute value containing N repeated '>' characters parses in O(N) time instead of O(N**2). Also fix the latent EOF handling in IOSource#match introduced with CVE-2024-41123 so the partially-filled buffer is matched against the pattern one last time before the source is declared exhausted, which is now exercised by the new value-rest read. - CVE-2024-35176 * SECURITY UPDATE: REXML ReDoS via repeated spaces in ATTLIST - debian/patches/CVE-2024-39908.patch: strip the matched ATTLIST contents before applying ATTDEF_RE so that trailing whitespace after a valid attdef does not trigger catastrophic backtracking in the per-attdef scan. Adapted byte-identically from upstream ruby/rexml@1f1e6e9; the other eight commits referenced by this CVE address O(N**2) source.match interactions that are already mitigated here by the min_bytes-doubling introduced in the CVE-2024-41123 backport (verified by microbench against all eight upstream test vectors at N=200000). - CVE-2024-39908 Moderate TuxCare License Agreement CVE-2024-35176 CVE-2024-39908 Debian 11 * SECURITY UPDATE: REXML DoS via many '<' or '>' characters in an attribute value - debian/patches/CVE-2024-35176.patch: in parse_attributes, when the outer @source.match stops at a '>' inside a quoted attribute value, read forward to the actual closing quote in a single chunk instead of looping one '>' at a time, so the per-attribute outer loop is O(1) iterations rather than O(n). Also extend IOSource#match to always re-try the regex after read() returns false at EOF so the final partially-filled buffer is still matched. - CVE-2024-35176 * SECURITY UPDATE: REXML ReDoS via repeated zeros in a character reference - debian/patches/CVE-2024-39908.patch: rewrite REXML::Text.check to iterate over '<' and '&' sentinels with String#index and validate each entity / character reference explicitly, instead of string.scan() with the NEEDS_A_SECOND_CHECK regex whose '&#0*' branch caused O(n^2) backtracking on inputs with many leading zeros. The remaining CVE-2024-39908 subvariants (repeated '>' inside <?xml, comments, CDATA, DOCTYPE forms) are already mitigated by the min_bytes-doubling IOSource#match introduced by CVE-2024-41123. - CVE-2024-39908 Moderate TuxCare License Agreement CVE-2024-35176 CVE-2024-39908 Debian 11 * SECURITY UPDATE: Heap buffer overflow in bundled zlib via Zlib::GzipReader#ungetc - debian/patches/CVE-2026-27820.patch: make the output-buffer expansion in zstream_buffer_ungets() unconditional via zstream_expand_buffer_into(z, len) instead of only growing when the buffer was already full. An ungetc payload larger than the remaining capacity previously made the memmove() calls write past the allocation, corrupting the heap. Adapted byte-identically from upstream ruby/zlib@608d2be6; the regression test test_ungetc_buffer_underflow is added to test/zlib/test_zlib.rb. - CVE-2026-27820 Critical TuxCare License Agreement CVE-2026-27820 Debian 11 * SECURITY UPDATE: rexml denial of service via multiple XML declarations - debian/patches/CVE-2025-58767.patch: validate XML declarations in bundled rexml-3.3.9 (require version, restrict to version/encoding/ standalone attributes, reject duplicates) and add Source#skip_spaces fast path; backport of upstream rexml commit 5859bdea (PR #282). - CVE-2025-58767 * SECURITY UPDATE: heap buffer overflow in Zlib::GzipReader#ungetc - debian/patches/CVE-2026-27820.patch: make the gzip output buffer expansion unconditional in zstream_buffer_ungets() so a large ungetc payload cannot memmove/write past the allocation (ext/zlib/zlib.c), plus regression test test_ungetc_buffer_underflow (test/zlib/test_zlib.rb). - CVE-2026-27820 Critical TuxCare License Agreement CVE-2026-27820 CVE-2025-58767 Debian 11 * SECURITY UPDATE: Heap buffer overflow in the bundled zlib extension via Zlib::GzipReader#ungetc - debian/patches/CVE-2026-27820.patch: in zstream_buffer_ungets() (ext/zlib/zlib.c) the output buffer was expanded only when it was already full (rb_str_capacity(z->buf) <= ZSTREAM_BUF_FILLED(z)), so a large ungetc payload memmove()'d and wrote past the allocation. Make the expansion unconditional via zstream_expand_buffer_into(z, len), which guarantees capacity for filled + len before the memmove. Also backports the upstream regression test test_ungetc_buffer_underflow. - CVE-2026-27820 Critical TuxCare License Agreement CVE-2026-27820 Debian 11 * SECURITY UPDATE: cgi and uri vulnerabilities in the bundled gems - debian/patches/CVE-2025-27219.patch: CGI::Cookie.parse merged repeated cookie names with an allocating array `+`, giving O(n^2) work and a DoS on crafted Cookie headers; merge in place with concat instead. - debian/patches/CVE-2025-27220.patch: CGI::Util#escapeElement and #unescapeElement used a lazy-backtracking regex vulnerable to ReDoS; replace with possessive/atomic forms that also handle unclosed tags. - debian/patches/CVE-2025-61594.patch: URI::Generic#merge / + leaked the base URI's password when only the host changed (bypass of CVE-2025-27221); clear userinfo atomically via authority accessors. - CVE-2025-27219 - CVE-2025-27220 - CVE-2025-61594 Important TuxCare License Agreement CVE-2025-61594 CVE-2025-27220 CVE-2025-27219 Debian 11 * SECURITY UPDATE: DoS in CGI::Cookie.parse via repeated cookie names - debian/patches/CVE-2025-27219.patch: merge repeated cookie values in place with cookies[name].concat(values) instead of the super-linear values = cookies[name].value + values, so a Cookie: header repeating one name parses in O(n) instead of O(n**2). Adapted byte-identically from upstream ruby/cgi@9907b76. - CVE-2025-27219 * SECURITY UPDATE: ReDoS in CGI::Util#escapeElement - debian/patches/CVE-2025-27220.patch: replace the lazy backtracking element matcher ((?:.|\n)*?>) in escapeElement and unescapeElement with possessive/atomic forms that cannot backtrack, so a crafted unterminated tag no longer triggers catastrophic backtracking. Adapted byte-identically from upstream ruby/cgi@c9d1311; the upstream unclosed-tag regression tests are added to test/cgi/test_cgi_util.rb. - CVE-2025-27220 * SECURITY UPDATE: URI password leak when combining URIs (CVE-2025-27221 bypass) - debian/patches/CVE-2025-61594.patch: clear userinfo fully in set_userinfo/set_user, clear it on host=/port=, add an authority reader and protected set_authority setter, and make merge replace the whole authority atomically so combining a base URI with a relative one no longer carries the base password to a new host. Backported from upstream ruby/uri d3116ca ("Clear user info totally..." fixing CVE-2025-27221, plus "Add authority accessor"); the merge() hunk is adapted to uri 0.10.0.2's layout. The test/uri/test_generic.rb#test_set_component expectations are updated and a test_merge_does_not_leak_credentials test is added. - CVE-2025-61594 Important TuxCare License Agreement CVE-2025-61594 CVE-2025-27220 CVE-2025-27219 Debian 11 * SECURITY UPDATE: credential leak in bundled uri when combining URIs - debian/patches/CVE-2025-61594.patch: clear stale userinfo when setting authority components and replace authority atomically on merge in the bundled uri 0.12.4 (lib/uri/generic.rb), so combining URIs with + / merge no longer re-attaches the base URI's password; backport of upstream uri 0.12.5 (commit d3116ca). Bypass of the CVE-2025-27221 fix. - CVE-2025-61594 Important TuxCare License Agreement CVE-2025-61594 Debian 11 * SECURITY UPDATE: ReDoS in the vendored Bundler::URI RFC3986 parser - debian/patches/CVE-2023-28755.patch: clamp the greedy quantifiers in Bundler::URI::RFC3986_Parser's RFC3986_URI and RFC3986_relative_ref to possessive form, so an invalid URI no longer backtracks quadratically before raising InvalidURIError. NOTE: the 2.7.8 tarball's own two RFC3986 uri copies are already fixed; the vulnerable parser comes from the ruby-rubygems-bundler-v2.2.24.txz override tree that replaces lib/bundler at build time, so this patch is applied from debian/rules after that substitution and is deliberately NOT listed in debian/patches/series. The vendored version.rb is left at 0.10.0 so the build-time bundler_uri_version assertion still holds. The same patch additionally carries the CVE-2023-36617 follow-up hardening of the leading whitespace quantifiers of both parsers that back URI.parse / URI.split, from upstream ruby/uri 9d7bcef ("Fix quadratic backtracking on invalid port number") and 9010ee2 ("Fix quadratic backtracking on invalid relative URI"), which always ship together: the rfc3986 PORT pattern and the rfc2396 ABS_URI / REL_URI patterns each go from greedy to possessive. No ELSLANG ticket exists for CVE-2023-36617, so it is documented here and in the patch header rather than listed as a tracked id. Applied to all four in-tree copies (lib/uri/rfc3986_parser.rb, lib/uri/rfc2396_parser.rb and both lib/bundler/vendor/uri equivalents), so no copy is left half-patched; the vendored pair carries the override tree's content at that point. Both changes are timing-only -- the accepted and rejected inputs are unchanged -- and upstream's test_rfc2822_parse_relative_uri and test_rfc3986_port_check regression tests are added verbatim to test/uri/test_parser.rb. - CVE-2023-28755 * SECURITY UPDATE: buffer over-read in StringIO#ungetc / #ungetbyte - debian/patches/CVE-2024-27280.patch: compute the expansion in strio_unget_bytes() as cl - (rest < 0 ? pos : len) instead of (rest < 0 ? cl-pos : cl+rest), so pushing back more bytes than the current position no longer over-extends the string and expose uninitialized heap memory through StringIO#string and a later #gets. Adapted byte-identically from upstream ruby/stringio a35268a; upstream's test_ungetc_fill / test_ungetbyte_fill are added to test/stringio/test_stringio.rb and equivalent examples to spec/ruby/library/stringio/ungetc_spec.rb and ungetbyte_spec.rb. STRINGIO_VERSION is deliberately not bumped because the default gemspec filename is derived from it. - CVE-2024-27280 * SECURITY UPDATE: code execution in RDoc via unrestricted deserialisation - debian/patches/CVE-2024-27281.patch: load .rdoc_options with YAML.safe_load and permitted_classes: [RDoc::Options, Symbol], and route all four RDoc::Store Marshal.load call sites through a new private marshal_load helper whose filter proc rejects any object that is not a plain scalar/container, Class, Encoding or an RDoc::-namespaced object. Backported from upstream ruby/rdoc 32ff6ba0 ("Filter marshaled objects"), 60a6d74e ("Use safe_load and safe_load_file for .rdoc_options") and the mandatory follow-up a5de13bf ("Fix NoMethodError for start_with"), i.e. rdoc 6.3.4.1. safe_load_file does not exist in psych 3.1.0, so the .rdoc_options call uses the earlier upstream form YAML.safe_load File.read(...). RDoc::VERSION is deliberately not bumped because the spec pins it. - CVE-2024-27281 * SECURITY UPDATE: arbitrary heap read in the regexp engine - debian/patches/CVE-2024-27282.patch: bail out of Onigmo's forward_search_range() and backward_search_range() when reg->dmin exceeds end - str, so a crafted pattern can no longer advance the search pointer past the end of the subject and match against out-of-bounds heap memory. Also record mem_start_stk[mem] before STACK_PUSH_MEM_END() in OP_MEMORY_END_PUSH_REC, fixing a use-after-free of the backtrack-stack pointer. Taken verbatim from the ruby_3_0 backports of upstream 33e5b47c and 989a2355 (ruby 3.0.7); ruby-2.7.8's regexec.c is identical to 3.0.6's at all three sites. - CVE-2024-27282 Moderate TuxCare License Agreement CVE-2024-27281 CVE-2023-28755 CVE-2024-27280 CVE-2024-27282 Debian 11 * SECURITY UPDATE: ReDoS in the bundler-vendored uri parsers - debian/patches/CVE-2023-28755.patch: clamp the unbounded quantifiers in RFC3986_URI and RFC3986_relative_ref to their possessive forms and group IPv6address inside the IP-literal alternation, in the bundler-vendored uri 0.10.1 (lib/bundler/vendor/uri/lib/uri/rfc3986_parser.rb), so a crafted URI no longer drives quadratic backtracking; backport of upstream ruby commit 14f025a7 (URI 0.10.0.2 for bundler). - CVE-2023-28755 * The same patch carries the two-part follow-up hardening that upstream ships together (both dated 2023-04-22, HackerOne #1958260), covering the per-component validation regexps the first fix left unclamped: - rfc3986_parser.rb: default_regexp's PORT entry gets a possessive leading whitespace run (upstream ruby/uri commit 9d7bcef1), so an attacker-supplied port assigned via Bundler::URI::Generic#port= (check_port) no longer drives quadratic backtracking. - rfc2396_parser.rb: the ABS_URI and REL_URI patterns get a possessive leading whitespace quantifier, '\A\s*' -> '\A\s*+' (upstream ruby/uri commit 9010ee25), so Bundler::URI::RFC2396_Parser#split / #parse -- reached through the public Bundler::URI::DEFAULT_PARSER and Bundler::URI::Parser constants -- no longer go quadratic on crafted input with a long run of leading whitespace. Both parsers of a uri copy are hardened together: patching only one would leave the copy half-fixed and still exploitable through the other. * The primary uri default gem is already hardened upstream (0.12.4) in both parsers and is not touched, and the vendored VERSION_CODE deliberately stays 001001 to keep the build-time bundler_uri_version assertion passing. Moderate TuxCare License Agreement CVE-2023-28755 alt-ruby30 alt-ruby30-default-gems alt-ruby30-devel alt-ruby30-doc alt-ruby30-libs alt-ruby30-rubygem-bigdecimal alt-ruby30-rubygem-bundler alt-ruby30-rubygem-io-console alt-ruby30-rubygem-irb alt-ruby30-rubygem-json alt-ruby30-rubygem-minitest alt-ruby30-rubygem-power-assert alt-ruby30-rubygem-psych alt-ruby30-rubygem-rake alt-ruby30-rubygem-rbs alt-ruby30-rubygem-rdoc alt-ruby30-rubygem-rexml alt-ruby30-rubygem-rss alt-ruby30-rubygem-test-unit alt-ruby30-rubygem-typeprof alt-ruby30-rubygems alt-ruby30-rubygems-devel alt-ruby27 alt-ruby27-default-gems alt-ruby27-devel alt-ruby27-doc alt-ruby27-libs alt-ruby27-rubygem-bigdecimal alt-ruby27-rubygem-bundler alt-ruby27-rubygem-io-console alt-ruby27-rubygem-irb alt-ruby27-rubygem-json alt-ruby27-rubygem-minitest alt-ruby27-rubygem-net-telnet alt-ruby27-rubygem-power-assert alt-ruby27-rubygem-psych alt-ruby27-rubygem-rake alt-ruby27-rubygem-rdoc alt-ruby27-rubygem-test-unit alt-ruby27-rubygem-typeprof alt-ruby27-rubygem-xmlrpc alt-ruby27-rubygems alt-ruby27-rubygems-devel alt-ruby31 alt-ruby31-bundled-gems alt-ruby31-default-gems alt-ruby31-devel alt-ruby31-doc alt-ruby31-libs alt-ruby31-rubygem-bigdecimal alt-ruby31-rubygem-bundler alt-ruby31-rubygem-io-console alt-ruby31-rubygem-irb alt-ruby31-rubygem-json alt-ruby31-rubygem-minitest alt-ruby31-rubygem-power-assert alt-ruby31-rubygem-psych alt-ruby31-rubygem-rake alt-ruby31-rubygem-rbs alt-ruby31-rubygem-rdoc alt-ruby31-rubygem-rexml alt-ruby31-rubygem-rss alt-ruby31-rubygem-test-unit alt-ruby31-rubygem-typeprof alt-ruby31-rubygems alt-ruby31-rubygems-devel amd64 0:3.0.7-171 amd64 0:3.0.0-171 amd64 0:2.2.33-171 amd64 0:0.5.7-171 amd64 0:1.3.5-171 amd64 0:2.5.1-171 amd64 0:5.14.2-171 amd64 0:1.2.1-171 amd64 0:3.3.2-171 amd64 0:13.0.3-171 amd64 0:1.4.0-171 amd64 0:6.3.4.1-171 amd64 0:3.2.5-171 amd64 0:0.2.9-171 amd64 0:3.3.7-171 amd64 0:0.15.2-171 amd64 0:3.2.33-171 amd64 0:2.7.8-3 amd64 0:2.0.0-3 amd64 0:2.2.24-3 amd64 0:0.5.6-3 amd64 0:1.2.6-3 amd64 0:2.3.0-3 amd64 0:5.13.0-3 amd64 0:0.2.0-3 amd64 0:1.1.7-3 amd64 0:3.1.0-3 amd64 0:13.0.1-3 amd64 0:6.2.1.1-3 amd64 0:3.3.4-3 amd64 0:0.3.0-3 amd64 0:3.1.6-3 amd64 0:2.7.8-4 amd64 0:2.0.0-4 amd64 0:2.2.24-4 amd64 0:0.5.6-4 amd64 0:1.2.6-4 amd64 0:2.3.0-4 amd64 0:5.13.0-4 amd64 0:0.2.0-4 amd64 0:1.1.7-4 amd64 0:3.1.0-4 amd64 0:13.0.1-4 amd64 0:6.2.1.1-4 amd64 0:3.3.4-4 amd64 0:0.3.0-4 amd64 0:3.1.6-4 amd64 0:3.0.7-172 amd64 0:3.0.0-172 amd64 0:2.2.33-172 amd64 0:0.5.7-172 amd64 0:1.3.5-172 amd64 0:2.5.1-172 amd64 0:5.14.2-172 amd64 0:1.2.1-172 amd64 0:3.3.2-172 amd64 0:13.0.3-172 amd64 0:1.4.0-172 amd64 0:6.3.4.1-172 amd64 0:3.2.5-172 amd64 0:0.2.9-172 amd64 0:3.3.7-172 amd64 0:0.15.2-172 amd64 0:3.2.33-172 amd64 0:2.7.8-5 amd64 0:2.0.0-5 amd64 0:2.2.24-5 amd64 0:0.5.6-5 amd64 0:1.2.6-5 amd64 0:2.3.0-5 amd64 0:5.13.0-5 amd64 0:0.2.0-5 amd64 0:1.1.7-5 amd64 0:3.1.0-5 amd64 0:13.0.1-5 amd64 0:6.2.1.1-5 amd64 0:3.3.4-5 amd64 0:0.3.0-5 amd64 0:3.1.6-5 amd64 0:3.1.7-10 amd64 0:3.1.1-10 amd64 0:2.3.27-10 amd64 0:0.5.11-10 amd64 0:1.4.1-10 amd64 0:2.6.1-10 amd64 0:5.15.0-10 amd64 0:2.0.1-10 amd64 0:4.0.4-10 amd64 0:13.0.6-10 amd64 0:2.7.0-10 amd64 0:6.4.1.1-10 amd64 0:3.3.9-10 amd64 0:0.3.1-10 amd64 0:3.5.3-10 amd64 0:0.21.3-10 amd64 0:3.3.27-10 amd64 0:3.0.7-173 amd64 0:3.0.0-173 amd64 0:2.2.33-173 amd64 0:0.5.7-173 amd64 0:1.3.5-173 amd64 0:2.5.1-173 amd64 0:5.14.2-173 amd64 0:1.2.1-173 amd64 0:3.3.2-173 amd64 0:13.0.3-173 amd64 0:1.4.0-173 amd64 0:6.3.4.1-173 amd64 0:3.2.5-173 amd64 0:0.2.9-173 amd64 0:3.3.7-173 amd64 0:0.15.2-173 amd64 0:3.2.33-173 amd64 0:3.0.7-174 amd64 0:3.0.0-174 amd64 0:2.2.33-174 amd64 0:0.5.7-174 amd64 0:1.3.5-174 amd64 0:2.5.1-174 amd64 0:5.14.2-174 amd64 0:1.2.1-174 amd64 0:3.3.2-174 amd64 0:13.0.3-174 amd64 0:1.4.0-174 amd64 0:6.3.4.1-174 amd64 0:3.2.5-174 amd64 0:0.2.9-174 amd64 0:3.3.7-174 amd64 0:0.15.2-174 amd64 0:3.2.33-174 amd64 0:2.7.8-6 amd64 0:2.0.0-6 amd64 0:2.2.24-6 amd64 0:0.5.6-6 amd64 0:1.2.6-6 amd64 0:2.3.0-6 amd64 0:5.13.0-6 amd64 0:0.2.0-6 amd64 0:1.1.7-6 amd64 0:3.1.0-6 amd64 0:13.0.1-6 amd64 0:6.2.1.1-6 amd64 0:3.3.4-6 amd64 0:0.3.0-6 amd64 0:3.1.6-6 amd64 0:3.1.7-11 amd64 0:3.1.1-11 amd64 0:2.3.27-11 amd64 0:0.5.11-11 amd64 0:1.4.1-11 amd64 0:2.6.1-11 amd64 0:5.15.0-11 amd64 0:2.0.1-11 amd64 0:4.0.4-11 amd64 0:13.0.6-11 amd64 0:2.7.0-11 amd64 0:6.4.1.1-11 amd64 0:3.3.9-11 amd64 0:0.3.1-11 amd64 0:3.5.3-11 amd64 0:0.21.3-11 amd64 0:3.3.27-11 amd64 0:2.7.8-7 amd64 0:2.0.0-7 amd64 0:2.2.24-7 amd64 0:0.5.6-7 amd64 0:1.2.6-7 amd64 0:2.3.0-7 amd64 0:5.13.0-7 amd64 0:0.2.0-7 amd64 0:1.1.7-7 amd64 0:3.1.0-7 amd64 0:13.0.1-7 amd64 0:6.2.1.1-7 amd64 0:3.3.4-7 amd64 0:0.3.0-7 amd64 0:3.1.6-7 amd64 0:3.1.7-12 amd64 0:3.1.1-12 amd64 0:2.3.27-12 amd64 0:0.5.11-12 amd64 0:1.4.1-12 amd64 0:2.6.1-12 amd64 0:5.15.0-12 amd64 0:2.0.1-12 amd64 0:4.0.4-12 amd64 0:13.0.6-12 amd64 0:2.7.0-12 amd64 0:6.4.1.1-12 amd64 0:3.3.9-12 amd64 0:0.3.1-12 amd64 0:3.5.3-12 amd64 0:0.21.3-12 amd64 0:3.3.27-12