[Git][security-tracker-team/security-tracker][master] 2 commits: lts: triage CVE-2025-11683/libyaml-syck-perl

Sun Oct 19 00:47:19 BST 2025


Daniel Leidert pushed to branch master at Debian Security Tracker / security-tracker


Commits:
aae1df0c by Daniel Leidert at 2025-10-18T22:18:25+02:00
lts: triage CVE-2025-11683/libyaml-syck-perl

Minor issue, postpone

- - - - -
72afc820 by Daniel Leidert at 2025-10-19T01:39:46+02:00
lts: triage ffmpeg issues CVE-2025-59729..CVE-2025-59734

Add report and patch links. Leave further triage to secteam. This is what the
situation looks like:

- CVE-2025-59729 and CVE-2025-59730 were introduced and fixed only in the
  8.0 branch
- CVE-2025-59731, CVE-2025-59732, and CVE-2025-59733 are fixed in
  7.1.2 (sid + trixie-security) and 5.1.7 (bookworm-security)
- CVE-2025-59734 might be open as report suggests that at least 7.1 series
  is affected as well, but only master and 8.0 were fixed; requires further
  examination

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -596,6 +596,7 @@ CVE-2025-11683 (YAML::Syck versions before 1.36 for Perl has missing null-termin
 	- libyaml-syck-perl 1.34-4
 	[trixie] - libyaml-syck-perl <no-dsa> (Minor issue)
 	[bookworm] - libyaml-syck-perl <no-dsa> (Minor issue)
+	[bullseye] - libyaml-syck-perl <postponed> (Minor issue)
 	NOTE: https://github.com/cpan-authors/YAML-Syck/pull/65
 	NOTE: https://github.com/cpan-authors/YAML-Syck/commit/dcf4c8477b82ef439f43fd20dc099082d096df02 (v1.36)
 CVE-2025-9967 (The Orion SMS OTP Verification plugin for WordPress is vulnerable to p ...)
@@ -4351,21 +4352,49 @@ CVE-2025-60956 (Cross Site Request Forgery (CSRF) vulnerability in EndRun Techno
 CVE-2025-59734 (It is possible to cause an use-after-free write in SANM decoding with  ...)
 	- ffmpeg <undetermined>
 	TODO: check, too little information available, only product association from Google CNA
+	NOTE: https://issuetracker.google.com/issues/440183164
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/d311382c38df9c2237b33a9e8e860a5da7d2895d (master)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c41a70b6bb79707e1e3a4b0e31950cd986b9f50e (master)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/af310e68db0791b94753a9670c9a9ef0d717e32a (n8.0)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/c3747e011e7c7107ad6ef4c9e0a1c26490e2c30f (n8.0)
+	NOTE: Report claims that version 7.1.1 is affected as well, but upstream has not released any fix for this series.
 CVE-2025-59733 (When decoding an OpenEXR file that uses DWAA or DWAB compression, ther ...)
 	- ffmpeg <undetermined>
 	TODO: check, too little information available, only product association from Google CNA
+	NOTE: https://issuetracker.google.com/issues/436511754
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/0469d68acb52081ca8385b844b9650398242be0f (master)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/de76fb27a6e6da0431154ce9093933281a38a889 (n8.0)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/a9ec8317498b62192cc3df95ef2523eae8ec0294 (n7.1.2)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/a2e8dc01c0a50d2ec8c85d836bda8eaef6891e50 (n6.1.3)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1080d0e3cded6d8e177c2ce8b6649bc238be2ff6 (n5.1.7)
 CVE-2025-59732 (When decoding an OpenEXR file that uses DWAA or DWAB compression, ther ...)
 	- ffmpeg <undetermined>
 	TODO: check, too little information available, only product association from Google CNA
+	NOTE: https://issuetracker.google.com/issues/436510316
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/f45da79b2c336c5f8f3e563d72b8a22fecdcde0c (n8.0)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/97932677dbc29c1173f3361886022426ac74197e (n7.1.2)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/fa543b33f63478090137d124c20ff97f76251254 (n6.1.3)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/20708b957e8d4d57801c0b7ac52131988b093a49 (n5.1.7)
 CVE-2025-59731 (When decoding an OpenEXR file that uses DWAA or DWAB compression, the  ...)
 	- ffmpeg <undetermined>
 	TODO: check, too little information available, only product association from Google CNA
+	NOTE: https://issuetracker.google.com/issues/436510153
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/0d9c003d76383e82b57b6d5aa33776709d0cda2c (n8.0)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/d7e188f33f638d85a1ab70943bde70359454b05c (n7.1.2)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/be682029ae18b80fa9b27f0715ca77323409379c (n6.1.3)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/ec959281897aa29076f3083edbc2306357342d7c (n5.1.7)
 CVE-2025-59730 (When decoding a frame for a SANM file (ANIM v0 variant), the decoded d ...)
 	- ffmpeg <undetermined>
 	TODO: check, too little information available, only product association from Google CNA
+	NOTE: https://issuetracker.google.com/issues/434637586
+	NOTE: Introduced by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/b22ce90d4228d1cb7727775cc848613ac31b97e9 (8.0 series)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/3ccd7d8c8e85aaae0c6d6cc88ea6cb5309d56cdc (n8.0)
 CVE-2025-59729 (When parsing the header for a DHAV file, there's an integer underflow  ...)
 	- ffmpeg <undetermined>
 	TODO: check, too little information available, only product association from Google CNA
+	NOTE: https://issuetracker.google.com/issues/433513232
+	NOTE: Introduced in: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/36ec9217e6dca3432304c9d76078d9618247eb0f (8.0 series)
+	NOTE: Fixed by: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/33ae6cda71e6d34c9081a612abae00e2c7d39f72 (n8.0)
 CVE-2025-59728 (When calculating the content path in handling of MPEG-DASH manifests,  ...)
 	NOT-FOR-US: MPEG-DASH
 CVE-2025-59452 (The YoSmart YoLink API through 2025-10-02 uses an endpoint URL that is ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/5efe898e7b3a16fae7c4cedea599457f9fd5673b...72afc820703fee8a2fbfb26335a1c8f8a1f6e414

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/5efe898e7b3a16fae7c4cedea599457f9fd5673b...72afc820703fee8a2fbfb26335a1c8f8a1f6e414
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20251018/02d40aa7/attachment.htm>
