https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2007-0227.htmlhttps://patchthecve.com/cve/CVE-2007-0227.htmlTue, 16 Jun 2026 22:35:09 +0000MEDIUM 5.0: slocate 3.1 does not properly manage database entries that specify names of files in protected directories, which allows local users to obtain the names of private files. NOTE: another researcher reports that the issue is not present in slocate 2.7.https://patchthecve.com/cve/CVE-2003-0848.htmlhttps://patchthecve.com/cve/CVE-2003-0848.htmlTue, 16 Jun 2026 22:03:04 +0000MEDIUM 4.6: Heap-based buffer overflow in main.c of slocate 2.6, and possibly other versions, may allow local users to gain privileges via a modified slocate database that causes a negative "pathlen" value to be used.https://patchthecve.com/cve/CVE-2003-0326.htmlhttps://patchthecve.com/cve/CVE-2003-0326.htmlTue, 16 Jun 2026 22:02:00 +0000MEDIUM 4.6: Integer overflow in parse_decode_path() of slocate may allow attackers to execute arbitrary code via a LOCATE_PATH with a large number of ":" (colon) characters, whose count is used in a call to malloc.https://patchthecve.com/cve/CVE-2003-0056.htmlhttps://patchthecve.com/cve/CVE-2003-0056.htmlTue, 16 Jun 2026 22:01:25 +0000HIGH 7.2: Buffer overflow in secure locate (slocate) before 2.7 allows local users to execute arbitrary code via a long (1) -c or (2) -r command line argument.