Skip to content
OpenAdvisories
High DSA-5632-1 1 CVE

composer - security update

Published Feb 26, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 11 composer 2.0.9-2+deb11u2
Debian · 12 composer 2.5.5-1+deb12u1

Vulnerabilities 1

  • High 8.8
    CVE-2024-24821

    Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer

    Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary c…

    composer composer composer/composer composer Debian Ubuntu Alpine Packagist