Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/6365?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/6365?format=api", "purl": "pkg:deb/debian/balsa@0.4.6.2-1", "type": "deb", "namespace": "debian", "name": "balsa", "version": "0.4.6.2-1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": null, "latest_non_vulnerable_version": null, "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/59763?format=api", "vulnerability_id": "VCID-81gt-krbp-abc8", "summary": "Stack-based buffer overflow in the ir_fetch_seq function in balsa before 2.3.20 might allow remote IMAP servers to execute arbitrary code via a long response to a FETCH command.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2007-5007.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2007-5007.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2007-5007", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00987", "scoring_system": "epss", "scoring_elements": "0.7719", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00987", "scoring_system": "epss", "scoring_elements": "0.77222", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2007-5007" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5007", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5007" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=297581", "reference_id": "297581", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=297581" }, { "reference_url": "https://security.gentoo.org/glsa/200710-17", "reference_id": "GLSA-200710-17", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/200710-17" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/6371?format=api", "purl": "pkg:deb/debian/balsa@2.3.25-1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-htkh-768g-gyb7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/balsa@2.3.25-1" } ], "aliases": [ "CVE-2007-5007" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-81gt-krbp-abc8" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/59758?format=api", "vulnerability_id": "VCID-c2v8-991f-9bck", "summary": "Multiple off-by-one buffer overflows in the IMAP capability for Mutt 1.3.28 and earlier, and Balsa 1.2.4 and earlier, allow a remote malicious IMAP server to cause a denial of service (crash) and possibly execute arbitrary code via a specially crafted mail folder, a different vulnerability than CVE-2003-0140.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2003-0167", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00931", "scoring_system": "epss", "scoring_elements": "0.76483", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00931", "scoring_system": "epss", "scoring_elements": "0.76512", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2003-0167" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0167", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0167" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/6368?format=api", "purl": "pkg:deb/debian/balsa@2.3.0-2sarge1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-81gt-krbp-abc8" }, { "vulnerability": "VCID-htkh-768g-gyb7" }, { "vulnerability": "VCID-n6na-y3zc-eqa2" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/balsa@2.3.0-2sarge1" } ], "aliases": [ "CVE-2003-0167" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-c2v8-991f-9bck" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/59766?format=api", "vulnerability_id": "VCID-htkh-768g-gyb7", "summary": "In GNOME Balsa before 2.6.0, a malicious server operator or man in the middle can trigger a NULL pointer dereference and client crash by sending a PREAUTH response to imap_mbox_connect in libbalsa/imap/imap-handle.c.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-16118", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00617", "scoring_system": "epss", "scoring_elements": "0.70321", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.00617", "scoring_system": "epss", "scoring_elements": "0.70362", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-16118" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16118", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16118" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/575205?format=api", "purl": "pkg:deb/debian/balsa@2.6.1-1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/balsa@2.6.1-1" } ], "aliases": [ "CVE-2020-16118" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-htkh-768g-gyb7" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/3126?format=api", "vulnerability_id": "VCID-n6na-y3zc-eqa2", "summary": "Gaëtan Leurent informed us of a weakness in APOP\nauthentication that could allow an attacker to recover the first\npart of your mail password if the attacker could interpose\na malicious mail server on your network masquerading as your legitimate\nmail server. With normal settings it could take several hours for\nthe attacker to gather enough data to recover just a few characters\nof the password. This result was presented at the\nFast Software Encryption 2007 conference.In a rump session at the same conference a team from The University of\nElectro-Communications claimed that a variant on the same hash-collision\nattack allowed them to recover a 31 character password.Fixed versions of Thunderbird and SeaMonkey mail prevent this\ntechnique by stricter enforcement of the Message-ID format used\nby APOP.POP mail accounts which do not use any authentication are\ncommon and in the same hypothetical situation the password could\nbe recovered immediately without any special programming on the\nattacker's part.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2007-1558.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2007-1558.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2007-1558", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.1342", "scoring_system": "epss", "scoring_elements": "0.94326", "published_at": "2026-06-04T12:55:00Z" }, { "value": "0.1342", "scoring_system": "epss", "scoring_elements": "0.94335", "published_at": "2026-06-05T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2007-1558" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=241191", "reference_id": "241191", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=241191" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558", "reference_id": "CVE-2007-1558", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558" }, { "reference_url": "https://security.gentoo.org/glsa/200706-06", "reference_id": "GLSA-200706-06", "reference_type": "", "scores": [], "url": "https://security.gentoo.org/glsa/200706-06" }, { "reference_url": "https://www.mozilla.org/en-US/security/advisories/mfsa2007-15", "reference_id": "mfsa2007-15", "reference_type": "", "scores": [ { "value": "none", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.mozilla.org/en-US/security/advisories/mfsa2007-15" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2007:0344", "reference_id": "RHSA-2007:0344", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2007:0344" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2007:0353", "reference_id": "RHSA-2007:0353", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2007:0353" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2007:0385", "reference_id": "RHSA-2007:0385", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2007:0385" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2007:0386", "reference_id": "RHSA-2007:0386", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2007:0386" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2007:0401", "reference_id": "RHSA-2007:0401", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2007:0401" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2007:0402", "reference_id": "RHSA-2007:0402", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2007:0402" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2009:1140", "reference_id": "RHSA-2009:1140", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2009:1140" }, { "reference_url": "https://usn.ubuntu.com/469-1/", "reference_id": "USN-469-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/469-1/" }, { "reference_url": "https://usn.ubuntu.com/520-1/", "reference_id": "USN-520-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/520-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/6371?format=api", "purl": "pkg:deb/debian/balsa@2.3.25-1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-htkh-768g-gyb7" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/balsa@2.3.25-1" } ], "aliases": [ "CVE-2007-1558" ], "risk_score": 0.1, "exploitability": "0.5", "weighted_severity": "0.1", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-n6na-y3zc-eqa2" } ], "fixing_vulnerabilities": [], "risk_score": "0.1", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:deb/debian/balsa@0.4.6.2-1" }