Packages / Debian 13 (Trixie) / php / composer

Package: composer (2.8.8-1+deb13u3)

dependency manager for PHP

Other Packages Related to composer:

  • rec: [git]

    fast, scalable, distributed revision control system

  • rec: [php-curl]

    CURL module for PHP [default]

  • rec: [php-intl]

    Internationalisation module for PHP [default]

  • rec: [php-mbstring]

    MBSTRING module for PHP [default]

  • rec: [php-zip]

    Zip module for PHP [default]

  • rec: [unzip]

    Entpacker für .zip-Dateien

  • rec: [xz-utils]

    XZ-format compression utilities

  • sug: [fossil]

    DSCM with built-in wiki, http interface and server, tickets database

  • sug: [mercurial]

    easy-to-use, scalable distributed version control system

  • sug: [subversion]

    Advanced version control system

Download composer

ArchitecturePackage sizeInstalled sizeFilesPackage
all521 KiB2.8 MiBlist of filesDownload

Paketdateipfade (0)

Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.

No package-associated file paths were observed for the displayed build metadata.

Field source: Debian 13 (Trixie) main amd64

Dieses Paket verwenden

OpenFactory kann dieses Betriebssystem in einer Browser-VM starten oder einen Image-Build mit dem nativen Paketnamen aus diesem Datensatz beginnen.

Versionen, Suiten und Repositories

Jede Zeile ist Paketindex-Metadaten für eine Version, Architektur, Suite und ein Repository. Namen, URLs und Größen stammen aus der Quelle; ein Link ist ein veränderbarer Abrufort, kein Weitergabanspruch von OpenFactory.

VersionReleaseArchitectureRepositoryPackage sizeInstalled sizePublisher repository artifact
2.8.8-1+deb13u3trixie / mainallDebian 13 · main · amd64521 KiB2.8 MiBpool/main/c/composer/composer_2.8.8-1+deb13u3_all.deb
2.8.8-1+deb13u3trixie / mainallDebian 13 · main · arm64521 KiB2.8 MiBpool/main/c/composer/composer_2.8.8-1+deb13u3_all.deb

Field source: Debian 13 (Trixie) main amd64

Bekannte Sicherheitslücken

Die Paketzuordnung läuft.

CVESchweregradBetroffene Versionen
[CVE-2026-59944]

Published:

composer: CVE-2026-59944

Medium(6.1)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Betroffen

    dsa · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Betroffen

    dsa · composer · debian · 13

[CVE-2026-84361]

Published:

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set s

High(7.7)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Betroffen

    nvd · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Betroffen

    nvd · composer · debian · 13

[CVE-2026-45793]

Published:

Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and in

High(7.5)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.8.8-1+deb13u3

    nvd · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.8.8-1+deb13u3

    nvd · composer · debian · 13

[CVE-2026-59947]

Published:

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, when Composer is run with -vvv debug verbosity, it could print a credential embedded in the username slot of a reposi

Medium(4.7)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Betroffen

    nvd · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Betroffen

    nvd · composer · debian · 13

[CVE-2026-59948]

Published:

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a maliciously crafted package from an untrusted repository other than Packagist.org or Private Packagist can cause Co

High(7)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Betroffen

    nvd · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Betroffen

    nvd · composer · debian · 13

[CVE-2026-59946]

Published:

Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause

Medium(6.1)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Betroffen

    nvd · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Betroffen

    nvd · composer · debian · 13

[CVE-2026-40176]

Published:

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::generateP4Command() method, which constructs shel

High(7.8)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.8.8-1+deb13u2

    nvd · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.8.8-1+deb13u2

    nvd · composer · debian · 13

[CVE-2026-40261]

Published:

Composer is a dependency manager for PHP. Versions 1.0 through 2.2.26 and 2.3 through 2.9.5 contain a command injection vulnerability in the Perforce::syncCodeBase() method, which appends the $sourceR

High(8.8)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.8.8-1+deb13u2

    nvd · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.8.8-1+deb13u2

    nvd · composer · debian · 13

[CVE-2025-67746]

Published:

composer: CVE-2025-67746

Low(3.5)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.8.8-1+deb13u1

    dsa · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.8.8-1+deb13u1

    dsa · composer · debian · 13

[CVE-2024-35241]

Published:

Composer vulnerabilities

High(8.8)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.7.7-1

    usn · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.7.7-1

    usn · composer · debian · 13

[CVE-2024-35242]

Published:

Composer vulnerabilities

High(8.8)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.7.7-1

    usn · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.7.7-1

    usn · composer · debian · 13

[CVE-2024-24821]

Published:

Composer vulnerabilities

High(7.8)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.7.1-1

    usn · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.7.1-1

    usn · composer · debian · 13

[CVE-2023-43655]

Published:

Composer vulnerabilities

Medium(6.4)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.6.4-1

    usn · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.6.4-1

    usn · composer · debian · 13

[CVE-2015-8371]

Published:

composer: CVE-2015-8371

MediumUnbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 1.0.0~alpha11-3

    dsa · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 1.0.0~alpha11-3

    dsa · composer · debian · 13

[CVE-2021-29472]

Published:

composer: CVE-2021-29472

High(8.8)Unbekannt

Die Paketzuordnung läuft. Beobachtet:

Details (2)
  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.0.9-2

    dsa · composer · debian · 13

  • 2.8.8-1+deb13u3 · all · trixie

    Behoben · Behoben: 2.0.9-2

    dsa · composer · debian · 13

Zuletzt synchronisiert:

[CVE-Katalog]

Prüfsummen

Repository signatures authenticate metadata. Artifact hashing is recorded separately. Neither establishes package safety.

2.8.8-1+deb13u3 / allBeobachtet Sep 1, 2026sha256 a90074b32a9c…9d0be0f9Prüfsumme der Quelle

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Prüfsumme der Quelle (sha256): a90074b32a9c24261234dbb246072f355a1329da506647d910efc6f39d0be0f9

Download prüfen

printf '%s %s\n' 'a90074b32a9c24261234dbb246072f355a1329da506647d910efc6f39d0be0f9' 'composer_2.8.8-1+deb13u3_all.deb' | sha256sum --check --strict -

Field source: Debian 13 (Trixie) main amd64

2.8.8-1+deb13u3 / allBeobachtet Sep 1, 2026sha256 a90074b32a9c…9d0be0f9Prüfsumme der Quelle

Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Prüfsumme der Quelle (sha256): a90074b32a9c24261234dbb246072f355a1329da506647d910efc6f39d0be0f9

Download prüfen

printf '%s %s\n' 'a90074b32a9c24261234dbb246072f355a1329da506647d910efc6f39d0be0f9' 'composer_2.8.8-1+deb13u3_all.deb' | sha256sum --check --strict -

Field source: Debian 13 (Trixie) main arm64

Quellen

  • Authoritative source; repository metadata signature verified

    Signaturnachweis

    trixie-main-amd64:3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3

    Repository-signature verification record
    Signed-object SHA-256
    98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
    Signer fingerprint
    4CB50190207B4758A3F73A796ED0E7B82643E131
    Keyring revision
    debian-archive-keyring.gpg
    SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
    Tool and policy
    gpgv (GnuPG) 2.4.9
    openfactory-software-catalog-signature-v1
    Verification time
    Sep 1, 2026
    Repository metadata hash linkage
    Path
    main/binary-amd64/Packages.xz
    Expected SHA-256
    3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
    Observed SHA-256
    3ab4e811cf4f3e5a335d382c58cc19d85f1abe7a4ef4689160ca1f637fa0e9b3
    Result
    match verified
  • Authoritative source; repository metadata signature verified

    Signaturnachweis

    trixie-main-arm64:753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908

    Repository-signature verification record
    Signed-object SHA-256
    98b25b5cd185c59d34aa6e4c3e9b5b8f01bbe9d104fe2dcfbcd30dc0a14a59ed
    Signer fingerprint
    4CB50190207B4758A3F73A796ED0E7B82643E131
    Keyring revision
    debian-archive-keyring.gpg
    SHA-256 506b815cbb32d9b6066b4a2aa524071e071761e7e7f68c3ac74f3061ba852017
    Tool and policy
    gpgv (GnuPG) 2.4.9
    openfactory-software-catalog-signature-v1
    Verification time
    Sep 1, 2026
    Repository metadata hash linkage
    Path
    main/binary-arm64/Packages.xz
    Expected SHA-256
    753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
    Observed SHA-256
    753da751bbc7a679f48bd1b623ffd4479cb6861c426118284c76eb82909e4908
    Result
    match verified