Vulnerability Reportrust:1.97.1-bookworm

This base/runtime image carries significant vulnerabilities that any image built on it would inherit; remediate them in the final image before production. An attacker could exploit heap overflows in OpenEXR (CVE-2023-5841) or OpenJPEG to execute arbitrary code when processing malicious image files, and glibc's CVE-2019-1010023 enables code execution if a victim runs ldd on a malicious ELF. The latter requires local user interaction, so restricting ldd usage on untrusted files eliminates that risk, but the high volume of exposed findings (1125 total) means images built on this base should apply distro security updates before release. Note: this is a general-purpose base/runtime image — many findings live in components that an application built on top may never load, so actual exploitability depends on the final image. For an accurate risk picture, re-scan the final application image with context.