https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-48188.htmlhttps://patchthecve.com/cve/CVE-2025-48188.htmlWed, 17 Jun 2026 09:29:17 +0000LOW 2.9: libpspp-core.a in GNU PSPP through 2.0.1 has an incorrect call from fill_buffer (in data/encrypted-file.c) to the Gnulib rijndaelDecrypt function, leading to a heap-based buffer over-read.https://patchthecve.com/cve/CVE-2025-47816.htmlhttps://patchthecve.com/cve/CVE-2025-47816.htmlWed, 17 Jun 2026 09:28:43 +0000LOW 2.9: libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause an spvxml-helpers.c spvxml_parse_attributes out-of-bounds read, related to extra content at the end of a document.https://patchthecve.com/cve/CVE-2025-47815.htmlhttps://patchthecve.com/cve/CVE-2025-47815.htmlWed, 17 Jun 2026 09:28:43 +0000MEDIUM 4.5: libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from zip_member_read_all) in zip-reader.c.https://patchthecve.com/cve/CVE-2025-47814.htmlhttps://patchthecve.com/cve/CVE-2025-47814.htmlWed, 17 Jun 2026 09:28:43 +0000MEDIUM 4.5: libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflate_read (called indirectly from spv_read_xml_member) in zip-reader.c.https://patchthecve.com/cve/CVE-2025-47229.htmlhttps://patchthecve.com/cve/CVE-2025-47229.htmlWed, 17 Jun 2026 09:27:37 +0000LOW 2.9: libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var_set_leave_quiet assertion failure and application exit) via crafted input data, such as data that triggers a call from src/data/dictionary.c code into src/data/variable.c code.