[Git][security-tracker-team/security-tracker][master] 2 commits: Triage gdcm issues as postponed for bullseye

[Markus Koschany (@apo)]

Markus Koschany pushed to branch master at Debian Security Tracker / security-tracker


Commits:
11857a9f by Markus Koschany at 2025-12-27T14:20:39+01:00
Triage gdcm issues as postponed for bullseye

CVE-2025-11266, CVE-2025-48429, CVE-2025-52582, CVE-2025-53618, CVE-2025-53619
are minor issues

- - - - -
f5bc8d48 by Markus Koschany at 2025-12-27T15:10:21+01:00
CVE-2025-53000,nbconvert: link to upstream bug report

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3829,6 +3829,7 @@ CVE-2025-53429 (Improper Control of Filename for Include/Require Statement in PH
 CVE-2025-53000 (The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to v ...)
 	- nbconvert <unfixed>
 	NOTE: https://www.imperva.com/blog/code-execution-in-jupyter-notebook-exports/
+	NOTE: https://github.com/jupyter/nbconvert/issues/2258
 	TODO: check, might only have a security impact on Windows
 CVE-2025-52768 (Improper Control of Filename for Include/Require Statement in PHP Prog ...)
 	NOT-FOR-US: WordPress plugin or theme
@@ -4181,11 +4182,13 @@ CVE-2025-53619 (An out-of-bounds read vulnerability exists in the JPEGBITSCodec:
 	- gdcm <unfixed> (bug #1123587)
 	[trixie] - gdcm <no-dsa> (Minor issue)
 	[bookworm] - gdcm <no-dsa> (Minor issue)
+	[bullseye] - gdcm <postponed> (Minor issue)
 	NOTE: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2210
 CVE-2025-53618 (An out-of-bounds read vulnerability exists in the JPEGBITSCodec::Inter ...)
 	- gdcm <unfixed> (bug #1123587)
 	[trixie] - gdcm <no-dsa> (Minor issue)
 	[bookworm] - gdcm <no-dsa> (Minor issue)
+	[bullseye] - gdcm <postponed> (Minor issue)
 	NOTE: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2210
 CVE-2025-53524 (Fuji Electric Monitouch V-SFT-6 is vulnerable to an out-of-bounds writ ...)
 	NOT-FOR-US: Fuji Electric
@@ -4193,11 +4196,13 @@ CVE-2025-52582 (An out-of-bounds read vulnerability exists in the Overlay::GrabO
 	- gdcm <unfixed> (bug #1123576)
 	[trixie] - gdcm <no-dsa> (Minor issue)
 	[bookworm] - gdcm <no-dsa> (Minor issue)
+	[bullseye] - gdcm <postponed> (Minor issue)
 	NOTE: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2211
 CVE-2025-48429 (An out-of-bounds read vulnerability exists in the RLECodec::DecodeBySt ...)
 	- gdcm <unfixed> (bug #1123589)
 	[trixie] - gdcm <no-dsa> (Minor issue)
 	[bookworm] - gdcm <no-dsa> (Minor issue)
+	[bullseye] - gdcm <postponed> (Minor issue)
 	NOTE: https://talosintelligence.com/vulnerability_reports/TALOS-2025-2214
 CVE-2025-34288 (Nagios XI versions prior to 2026R1.1 arevulnerable to local privilege  ...)
 	NOT-FOR-US: Nagios XI
@@ -6162,6 +6167,7 @@ CVE-2025-11266 (An out-of-bounds write vulnerability exists in the Grassroots DI
 	- gdcm 3.0.24-8 (bug #1122862)
 	[trixie] - gdcm <no-dsa> (Minor issue)
 	[bookworm] - gdcm <no-dsa> (Minor issue)
+	[bullseye] - gdcm <postponed> (Minor issue)
 	NOTE: Fixed by: https://github.com/malaterre/GDCM/commit/5829c95c8ac3afa9a3a3413675e948959c28a789 (v3.2.2)
 CVE-2025-11164 (The Mavix Education theme for WordPress is vulnerable to unauthorized  ...)
 	NOT-FOR-US: WordPress plugin



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/0b77c9385962f1bead8e937695a49e5845f75620...f5bc8d487cc932649644c230c4ee8d7dff5446d4

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/0b77c9385962f1bead8e937695a49e5845f75620...f5bc8d487cc932649644c230c4ee8d7dff5446d4
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20251227/ca0f9424/attachment-0001.htm>