[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Sep 11 21:15:49 BST 2025
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
72e1ba55 by security tracker role at 2025-09-11T20:12:34+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,235 +1,313 @@
-CVE-2025-39791 [dm: dm-crypt: Do not partially accept write BIOs with zoned targets]
+CVE-2025-9319 (A potential vulnerability was reported in the Lenovo Wallpaper Client ...)
+ TODO: check
+CVE-2025-9214 (A missing authentication vulnerability was reported in some Lenovo pri ...)
+ TODO: check
+CVE-2025-9201 (A potential DLL hijacking vulnerability was discovered in Lenovo Brows ...)
+ TODO: check
+CVE-2025-9018 (The Time Tracker plugin for WordPress is vulnerable to unauthorized mo ...)
+ TODO: check
+CVE-2025-8716 (In Content Management versions 20.4- 25.3 authenticated attackers may ...)
+ TODO: check
+CVE-2025-8557 (An internal product security audit of Lenovo XClarity Orchestrator (LX ...)
+ TODO: check
+CVE-2025-8061 (A potential insufficient access control vulnerability was reported in ...)
+ TODO: check
+CVE-2025-59055 (InstantCMS is a free and open source content management system. A blin ...)
+ TODO: check
+CVE-2025-59053 (AIRI is a self-hosted, artificial intelligence based Grok Companion. I ...)
+ TODO: check
+CVE-2025-59047 (matrix-sdk-base is the base component to build a Matrix client library ...)
+ TODO: check
+CVE-2025-58321 (Delta Electronics DIALink has an Directory Traversal Authentication By ...)
+ TODO: check
+CVE-2025-58320 (Delta Electronics DIALink has an Directory Traversal Authentication By ...)
+ TODO: check
+CVE-2025-58065 (Flask-AppBuilder is an application development framework. Prior to ver ...)
+ TODO: check
+CVE-2025-56556 (An issue was discovered in Subrion CMS 4.2.1, allowing authenticated a ...)
+ TODO: check
+CVE-2025-48041 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2025-48040 (Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh ...)
+ TODO: check
+CVE-2025-48039 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2025-48038 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
+ TODO: check
+CVE-2025-43790 (Insecure Direct Object Reference (IDOR) vulnerability in Liferay Porta ...)
+ TODO: check
+CVE-2025-43782 (Insecure Direct Object Reference (IDOR) vulnerability in Liferay Porta ...)
+ TODO: check
+CVE-2025-40696 (Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PH ...)
+ TODO: check
+CVE-2025-40695 (Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PH ...)
+ TODO: check
+CVE-2025-40694 (Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PH ...)
+ TODO: check
+CVE-2025-40693 (Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PH ...)
+ TODO: check
+CVE-2025-40692 (SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This ...)
+ TODO: check
+CVE-2025-40691 (SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This ...)
+ TODO: check
+CVE-2025-40690 (SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This ...)
+ TODO: check
+CVE-2025-40689 (SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This ...)
+ TODO: check
+CVE-2025-40687 (SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This ...)
+ TODO: check
+CVE-2025-26499 (Under heavy system utilization a random race condition can occur durin ...)
+ TODO: check
+CVE-2025-10255 (A vulnerability was determined in Ascensio System SIA OnlyOffice up to ...)
+ TODO: check
+CVE-2025-10254 (A vulnerability was found in Ascensio System SIA OnlyOffice up to 12.7 ...)
+ TODO: check
+CVE-2025-10253 (A vulnerability has been found in openDCIM 23.04. This vulnerability a ...)
+ TODO: check
+CVE-2025-10252 (A flaw has been found in SEAT Queue Ticket Kiosk up to 20250827. This ...)
+ TODO: check
+CVE-2025-10251 (A vulnerability was detected in FoxCMS up to 1.24. Affected by this is ...)
+ TODO: check
+CVE-2025-10250 (A weakness has been identified in DJI Mavic Spark, Mavic Air and Mavic ...)
+ TODO: check
+CVE-2025-10193 (DNS rebinding vulnerability in Neo4j Cypher MCP server allows maliciou ...)
+ TODO: check
+CVE-2025-10127 (Daikin Security Gateway is vulnerable to an authorization bypass throu ...)
+ TODO: check
+CVE-2025-39791 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 6.16.5-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/e549663849e5bb3b985dc2d293069f0d9747ae72 (6.17-rc1)
-CVE-2025-39790 [bus: mhi: host: Detect events pointing to unexpected TREs]
+CVE-2025-39790 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.16.5-1
NOTE: https://git.kernel.org/linus/5bd398e20f0833ae8a1267d4f343591a2dd20185 (6.17-rc1)
-CVE-2025-39789 [crypto: x86/aegis - Add missing error checks]
+CVE-2025-39789 (In the Linux kernel, the following vulnerability has been resolved: c ...)
- linux 6.16.5-1
NOTE: https://git.kernel.org/linus/3d9eb180fbe8828cce43bce4c370124685b205c3 (6.17-rc1)
-CVE-2025-39788 [scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE]
+CVE-2025-39788 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 6.16.5-1
NOTE: https://git.kernel.org/linus/01aad16c2257ab8ff33b152b972c9f2e1af47912 (6.17-rc1)
-CVE-2025-39787 [soc: qcom: mdt_loader: Ensure we don't read past the ELF header]
+CVE-2025-39787 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 6.16.5-1
NOTE: https://git.kernel.org/linus/9f9967fed9d066ed3dae9372b45ffa4f6fccfeef (6.17-rc1)
-CVE-2025-39786 [iio: adc: ad7173: fix channels index for syscalib_mode]
+CVE-2025-39786 (In the Linux kernel, the following vulnerability has been resolved: i ...)
- linux 6.16.5-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/0eb8d7b25397330beab8ee62c681975b79f37223 (6.17-rc1)
-CVE-2025-39785 [drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local]
+CVE-2025-39785 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 6.16.5-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/8bed4ec42a4e0dc8113172696ff076d1eb6d8bcb (6.17-rc3)
-CVE-2025-39784 [PCI: Fix link speed calculation on retrain failure]
+CVE-2025-39784 (In the Linux kernel, the following vulnerability has been resolved: P ...)
- linux 6.16.5-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/9989e0ca7462c62f93dbc62f684448aa2efb9226 (6.17-rc1)
-CVE-2025-39783 [PCI: endpoint: Fix configfs group list head handling]
+CVE-2025-39783 (In the Linux kernel, the following vulnerability has been resolved: P ...)
- linux 6.16.5-1
NOTE: https://git.kernel.org/linus/d79123d79a8154b4318529b7b2ff7e15806f480b (6.17-rc1)
-CVE-2025-39782 [jbd2: prevent softlockup in jbd2_log_do_checkpoint()]
+CVE-2025-39782 (In the Linux kernel, the following vulnerability has been resolved: j ...)
- linux 6.16.5-1
NOTE: https://git.kernel.org/linus/9d98cf4632258720f18265a058e62fde120c0151 (6.17-rc3)
-CVE-2025-39781 [parisc: Drop WARN_ON_ONCE() from flush_cache_vmap]
+CVE-2025-39781 (In the Linux kernel, the following vulnerability has been resolved: p ...)
- linux 6.16.5-1
NOTE: https://git.kernel.org/linus/4eab1c27ce1f0e89ab67b01bf1e4e4c75215708a (6.17-rc1)
-CVE-2025-39780 [sched/ext: Fix invalid task state transitions on class switch]
+CVE-2025-39780 (In the Linux kernel, the following vulnerability has been resolved: s ...)
- linux 6.16.5-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/ddf7233fcab6c247379d0928d46cc316ee122229 (6.17-rc3)
-CVE-2025-39779 [btrfs: subpage: keep TOWRITE tag until folio is cleaned]
+CVE-2025-39779 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.16.5-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/b1511360c8ac882b0c52caa263620538e8d73220 (6.17-rc3)
-CVE-2025-39777 [crypto: acomp - Fix CFI failure due to type punning]
+CVE-2025-39777 (In the Linux kernel, the following vulnerability has been resolved: c ...)
- linux 6.16.5-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/962ddc5a7a4b04c007bba0f3e7298cda13c62efd (6.17-rc1)
-CVE-2025-39776 [mm/debug_vm_pgtable: clear page table entries at destroy_args()]
+CVE-2025-39776 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 6.16.5-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/dde30854bddfb5d69f30022b53c5955a41088b33 (6.17-rc3)
-CVE-2025-39775 [mm/mremap: fix WARN with uffd that has remap events disabled]
+CVE-2025-39775 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 6.16.5-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/772e5b4a5e8360743645b9a466842d16092c4f94 (6.17-rc3)
-CVE-2025-39774 [iio: adc: rzg2l_adc: Set driver data before enabling runtime PM]
+CVE-2025-39774 (In the Linux kernel, the following vulnerability has been resolved: i ...)
- linux 6.16.5-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/c69e13965f26b8058f538ea8bdbd2d7718cf1fbe (6.17-rc3)
-CVE-2025-39773 [net: bridge: fix soft lockup in br_multicast_query_expired()]
+CVE-2025-39773 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 6.16.5-1
NOTE: https://git.kernel.org/linus/d1547bf460baec718b3398365f8de33d25c5f36f (6.17-rc3)
-CVE-2025-39772 [drm/hisilicon/hibmc: fix the hibmc loaded failed bug]
+CVE-2025-39772 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 6.16.5-1
NOTE: https://git.kernel.org/linus/93a08f856fcc5aaeeecad01f71bef3088588216a (6.17-rc3)
-CVE-2025-39771 [regulator: pca9450: Use devm_register_sys_off_handler]
+CVE-2025-39771 (In the Linux kernel, the following vulnerability has been resolved: r ...)
- linux 6.16.5-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/447be50598c05499f7ccc2b1f6ddb3da30f8099a (6.17-rc3)
-CVE-2025-39770 [net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM]
+CVE-2025-39770 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 6.16.5-1
NOTE: https://git.kernel.org/linus/864e3396976ef41de6cc7bc366276bf4e084fff2 (6.17-rc3)
-CVE-2025-39769 [bnxt_en: Fix lockdep warning during rmmod]
+CVE-2025-39769 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.16.5-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/4611d88a37cfc18cbabc6978aaf7325d1ae3f53a (6.17-rc3)
-CVE-2025-39768 [net/mlx5: HWS, fix complex rules rehash error flow]
+CVE-2025-39768 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 6.16.5-1
[trixie] - linux <not-affected> (Vulnerable code not present)
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/4a842b1bf18a32ee0c25dd6dd98728b786a76fe4 (6.17-rc3)
-CVE-2025-39767 [LoongArch: Optimize module load time by optimizing PLT/GOT counting]
+CVE-2025-39767 (In the Linux kernel, the following vulnerability has been resolved: L ...)
- linux 6.16.5-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/63dbd8fb2af3a89466538599a9acb2d11ef65c06 (6.17-rc3)
-CVE-2025-39766 [net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit]
+CVE-2025-39766 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 6.16.5-1
NOTE: https://git.kernel.org/linus/15de71d06a400f7fdc15bf377a2552b0ec437cf5 (6.17-rc3)
-CVE-2025-39765 [ALSA: timer: fix ida_free call while not allocated]
+CVE-2025-39765 (In the Linux kernel, the following vulnerability has been resolved: A ...)
- linux 6.16.5-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/5003a65790ed66be882d1987cc2ca86af0de3db1 (6.17-rc3)
-CVE-2025-39764 [netfilter: ctnetlink: remove refcounting in expectation dumpers]
+CVE-2025-39764 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 6.16.3-1
NOTE: https://git.kernel.org/linus/1492e3dcb2be3aa46d1963da96aa9593e4e4db5a (6.17-rc2)
-CVE-2025-39763 [ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered]
+CVE-2025-39763 (In the Linux kernel, the following vulnerability has been resolved: A ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/79a5ae3c4c5eb7e38e0ebe4d6bf602d296080060 (6.17-rc1)
-CVE-2025-39762 [drm/amd/display: add null check]
+CVE-2025-39762 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 6.16.3-1
NOTE: https://git.kernel.org/linus/158b9201c17fc93ed4253c2f03b77fd2671669a1 (6.17-rc1)
-CVE-2025-39761 [wifi: ath12k: Decrement TID on RX peer frag setup error handling]
+CVE-2025-39761 (In the Linux kernel, the following vulnerability has been resolved: w ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/7c0884fcd2ddde0544d2e77f297ae461e1f53f58 (6.17-rc1)
-CVE-2025-39760 [usb: core: config: Prevent OOB read in SS endpoint companion parsing]
+CVE-2025-39760 (In the Linux kernel, the following vulnerability has been resolved: u ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/cf16f408364efd8a68f39011a3b073c83a03612d (6.17-rc1)
-CVE-2025-39759 [btrfs: qgroup: fix race between quota disable and quota rescan ioctl]
+CVE-2025-39759 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.16.3-1
NOTE: https://git.kernel.org/linus/e1249667750399a48cafcf5945761d39fa584edf (6.17-rc1)
-CVE-2025-39758 [RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages]
+CVE-2025-39758 (In the Linux kernel, the following vulnerability has been resolved: R ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/c18646248fed07683d4cee8a8af933fc4fe83c0d (6.17-rc1)
-CVE-2025-39757 [ALSA: usb-audio: Validate UAC3 cluster segment descriptors]
+CVE-2025-39757 (In the Linux kernel, the following vulnerability has been resolved: A ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/ecfd41166b72b67d3bdeb88d224ff445f6163869 (6.17-rc2)
-CVE-2025-39756 [fs: Prevent file descriptor table allocations exceeding INT_MAX]
+CVE-2025-39756 (In the Linux kernel, the following vulnerability has been resolved: f ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/04a2c4b4511d186b0fce685da21085a5d4acd370 (6.17-rc1)
-CVE-2025-39754 [mm/smaps: fix race between smaps_hugetlb_range and migration]
+CVE-2025-39754 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/45d19b4b6c2d422771c29b83462d84afcbb33f01 (6.17-rc2)
-CVE-2025-39753 [gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops]
+CVE-2025-39753 (In the Linux kernel, the following vulnerability has been resolved: g ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/5c8f12cf1e64e0e8e6cb80b0c935389973e8be8d (6.17-rc1)
-CVE-2025-39752 [ARM: rockchip: fix kernel hang during smp initialization]
+CVE-2025-39752 (In the Linux kernel, the following vulnerability has been resolved: A ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/7cdb433bb44cdc87dc5260cdf15bf03cc1cd1814 (6.17-rc1)
-CVE-2025-39751 [ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control]
+CVE-2025-39751 (In the Linux kernel, the following vulnerability has been resolved: A ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/a409c60111e6bb98fcabab2aeaa069daa9434ca0 (6.17-rc1)
-CVE-2025-39750 [wifi: ath12k: Correct tid cleanup when tid setup fails]
+CVE-2025-39750 (In the Linux kernel, the following vulnerability has been resolved: w ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/4a2bf707270f897ab8077baee8ed5842a5321686 (6.17-rc1)
-CVE-2025-39749 [rcu: Protect ->defer_qs_iw_pending from data race]
+CVE-2025-39749 (In the Linux kernel, the following vulnerability has been resolved: r ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/90c09d57caeca94e6f3f87c49e96a91edd40cbfd (6.17-rc1)
-CVE-2025-39748 [bpf: Forget ranges when refining tnum after JSET]
+CVE-2025-39748 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/6279846b9b2532e1b04559ef8bd0dec049f29383 (6.17-rc1)
-CVE-2025-39747 [drm/msm: Add error handling for krealloc in metadata setup]
+CVE-2025-39747 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/1c8c354098ea9d4376a58c96ae6b65288a6f15d8 (6.17-rc1)
-CVE-2025-39746 [wifi: ath10k: shutdown driver when hardware is unreliable]
+CVE-2025-39746 (In the Linux kernel, the following vulnerability has been resolved: w ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/c256a94d1b1b15109740306f7f2a7c2173e12072 (6.17-rc1)
-CVE-2025-39745 [rcutorture: Fix rcutorture_one_extend_check() splat in RT kernels]
+CVE-2025-39745 (In the Linux kernel, the following vulnerability has been resolved: r ...)
- linux 6.16.3-1
NOTE: https://git.kernel.org/linus/8d71351d88e478d3c4e945e3218e97ec677fd807 (6.17-rc1)
-CVE-2025-39744 [rcu: Fix rcu_read_unlock() deadloop due to IRQ work]
+CVE-2025-39744 (In the Linux kernel, the following vulnerability has been resolved: r ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/b41642c87716bbd09797b1e4ea7d904f06c39b7b (6.17-rc1)
-CVE-2025-39743 [jfs: truncate good inode pages when hard link is 0]
+CVE-2025-39743 (In the Linux kernel, the following vulnerability has been resolved: j ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/2d91b3765cd05016335cd5df5e5c6a29708ec058 (6.17-rc1)
-CVE-2025-39742 [RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask()]
+CVE-2025-39742 (In the Linux kernel, the following vulnerability has been resolved: R ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/59f7d2138591ef8f0e4e4ab5f1ab674e8181ad3a (6.17-rc1)
-CVE-2025-39741 [drm/xe/migrate: don't overflow max copy size]
+CVE-2025-39741 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/4126cb327a2e3273c81fcef1c594c5b7b645c44c (6.17-rc2)
-CVE-2025-39740 [drm/xe/migrate: prevent potential UAF]
+CVE-2025-39740 (In the Linux kernel, the following vulnerability has been resolved: d ...)
- linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/145832fbdd17b1d77ffd6cdd1642259e101d1b7e (6.17-rc2)
-CVE-2025-39739 [iommu/arm-smmu-qcom: Add SM6115 MDSS compatible]
+CVE-2025-39739 (In the Linux kernel, the following vulnerability has been resolved: i ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/f7fa8520f30373ce99c436c4d57c76befdacbef3 (6.17-rc1)
-CVE-2025-39738 [btrfs: do not allow relocation of partially dropped subvolumes]
+CVE-2025-39738 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/4289b494ac553e74e86fed1c66b2bf9530bc1082 (6.17-rc2)
-CVE-2025-39737 [mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()]
+CVE-2025-39737 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/d1534ae23c2b6be350c8ab060803fbf6e9682adc (6.17-rc2)
-CVE-2025-39736 [mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock]
+CVE-2025-39736 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 6.16.3-1
[trixie] - linux 6.12.43-1
NOTE: https://git.kernel.org/linus/47b0f6d8f0d2be4d311a49e13d2fd5f152f492b2 (6.17-rc2)
-CVE-2025-40300 [x86/vmscape: Enable the mitigation]
+CVE-2025-40300 (In the Linux kernel, the following vulnerability has been resolved: x ...)
- linux 6.16.7-1
NOTE: https://git.kernel.org/linus/2f8f173413f1cbf52660d04df92d0069c4306d25
NOTE: https://git.kernel.org/linus/556c1ad666ad90c50ec8fccb930dd5046cfbecfb
-CVE-2025-58364
+CVE-2025-58364 (OpenPrinting CUPS is an open source printing system for Linux and othe ...)
+ {DSA-5998-1}
- cups 2.4.10-4
NOTE: https://www.openwall.com/lists/oss-security/2025/09/11/2
NOTE: Fixed by: https://github.com/OpenPrinting/cups/commit/e58cba9d6fceed4242980e51dbd1302cf638ab1d (v2.4.13)
-CVE-2025-58060
+CVE-2025-58060 (OpenPrinting CUPS is an open source printing system for Linux and othe ...)
+ {DSA-5998-1}
- cups 2.4.10-4
NOTE: https://www.openwall.com/lists/oss-security/2025/09/11/1
NOTE: Fixed by: https://github.com/OpenPrinting/cups/commit/595d691075b1d396d2edfaa0a8fd0873a0a1f221 (v2.4.13)
@@ -1413,10 +1491,12 @@ CVE-2014-125128 ('sanitize-html' prior to version 1.0.3 is vulnerable to Cross-s
CVE-2025-40930 (JSON::SIMD before version 1.07 and earlier for Perl has an integer buf ...)
NOT-FOR-US: JSON::SIMD Perl module
CVE-2025-40929 (Cpanel::JSON::XS before version 4.40 for Perl has an integer buffer ov ...)
+ {DSA-6000-1}
- libcpanel-json-xs-perl 4.39-2
NOTE: https://lists.security.metacpan.org/cve-announce/msg/32608920/
NOTE: Fixed by: https://github.com/rurban/Cpanel-JSON-XS/commit/378236219eaa35742c3962ecbdee364903b0a1f2 (4.40)
CVE-2025-40928 (JSON::XS before version 4.04 for Perl has an integer buffer overflow c ...)
+ {DSA-5999-1}
- libjson-xs-perl 4.030-3
NOTE: https://lists.security.metacpan.org/cve-announce/msg/32608909/
NOTE: https://security.metacpan.org/patches/J/JSON-XS/4.03/CVE-2025-40928-r1.patch
@@ -1685,7 +1765,7 @@ CVE-2025-10027 (A vulnerability was determined in itsourcecode POS Point of Sale
CVE-2025-10003 (The UsersWP \u2013 Front-end login form, User Registration, User Profi ...)
NOT-FOR-US: WordPress plugin
CVE-2025-57807 (ImageMagick is free and open-source software used for editing and mani ...)
- {DLA-4297-1}
+ {DSA-5997-1 DLA-4297-1}
- imagemagick 8:7.1.2.3+dfsg1-1 (bug #1114520)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-23hg-53q6-hqfg
NOTE: https://github.com/ImageMagick/ImageMagick/commit/077a417a19a5ea8c85559b602754a5b928eef23e (7.1.2-3)
@@ -5170,7 +5250,7 @@ CVE-2025-57813 (traQ is a messenger application built for Digital Creators Club
CVE-2025-57810 (jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, use ...)
- jspdf <itp> (bug #998381)
CVE-2025-57803 (ImageMagick is free and open-source software used for editing and mani ...)
- {DLA-4297-1}
+ {DSA-5997-1 DLA-4297-1}
- imagemagick 8:7.1.2.3+dfsg1-1 (bug #1112469)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-mxvv-97wh-cfmm
NOTE: https://github.com/ImageMagick/ImageMagick/commit/2c55221f4d38193adcb51056c14cf238fbcc35d7 (7.1.2-2)
@@ -7800,7 +7880,7 @@ CVE-2025-38554 (In the Linux kernel, the following vulnerability has been resolv
- linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/9bbffee67ffd16360179327b57f3b1245579ef08 (6.17-rc1)
CVE-2025-55298 (ImageMagick is free and open-source software used for editing and mani ...)
- {DLA-4297-1}
+ {DSA-5997-1 DLA-4297-1}
- imagemagick 8:7.1.2.3+dfsg1-1 (bug #1111586)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9ccg-6pjw-x645
NOTE: Fixed by [1/2]: https://github.com/ImageMagick/ImageMagick/commit/1f93323df9d8c011c31bc4c6880390071f7fb895 (7.1.2-2)
@@ -7808,7 +7888,7 @@ CVE-2025-55298 (ImageMagick is free and open-source software used for editing an
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/731ce3a7aa7fabebaa322711c04ce5f5cf22edf4 (6.9.13-28)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/d789bdf7aabb955b88fbc95653aa9dbf6c5d259f (6.9.13-28)
CVE-2025-55212 (ImageMagick is free and open-source software used for editing and mani ...)
- {DLA-4297-1}
+ {DSA-5997-1 DLA-4297-1}
- imagemagick 8:7.1.2.3+dfsg1-1 (bug #1111587)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-fh55-q5pj-pxgw
NOTE: Fixed by [1/2]: https://github.com/ImageMagick/ImageMagick/commit/43d92bf855155e8e716ecbb50ed94c2ed41ff9f6 (7.1.2-2)
@@ -9440,7 +9520,7 @@ CVE-2025-55160 (ImageMagick is free and open-source software used for editing an
NOTE: https://github.com/ImageMagick/ImageMagick6/commit/986bddf243da88768e8198ee07c758768c098108 (6.9.13-27)
NOTE: Negligible security impact
CVE-2025-55154 (ImageMagick is free and open-source software used for editing and mani ...)
- {DLA-4297-1}
+ {DSA-5997-1 DLA-4297-1}
- imagemagick 8:7.1.2.1+dfsg1-1 (bug #1111103)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-qp29-wxp5-wh82
NOTE: https://github.com/ImageMagick/ImageMagick/commit/db986e4782e9f6cc42a0e50151dc4fe43641b337 (7.1.2-1)
@@ -12569,9 +12649,9 @@ CVE-2025-45150 (Insecure permissions in LangChain-ChatGLM-Webui commit ef829 all
NOT-FOR-US: LangChain-ChatGLM-Webui
CVE-2025-44139 (Emlog Pro V2.5.7 is vulnerable to Unrestricted Upload of File with Dan ...)
NOT-FOR-US: Emlog Pro
-CVE-2025-41376 (A SQL injection vulnerability has been found in Gandia Integra Total o ...)
+CVE-2025-41376 (CRLF Injection vulnerability in Limesurvey v2.65.1+170522. This vulner ...)
NOT-FOR-US: Gandia Integra Total of TESI
-CVE-2025-41375 (A SQL injection vulnerability has been found in Gandia Integra Total o ...)
+CVE-2025-41375 (SQL Injection vulnerability in Limesurvey v2.65.1+170522. This vulnera ...)
NOT-FOR-US: Gandia Integra Total of TESI
CVE-2025-41374 (A SQL injection vulnerability has been found in Gandia Integra Total o ...)
NOT-FOR-US: Gandia Integra Total of TESI
@@ -21125,23 +21205,23 @@ CVE-2024-9453 (A vulnerability was found in Red Hat OpenShift Jenkins. The beare
CVE-2025-58146
- xen-api <removed>
NOTE: https://xenbits.xen.org/xsa/advisory-474.html
-CVE-2025-58144
+CVE-2025-58144 ([This CNA information record relates to multiple CVEs; the text explai ...)
- xen <unfixed>
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
NOTE: https://xenbits.xen.org/xsa/advisory-473.html
-CVE-2025-58145
+CVE-2025-58145 ([This CNA information record relates to multiple CVEs; the text explai ...)
- xen <unfixed>
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
NOTE: https://xenbits.xen.org/xsa/advisory-473.html
-CVE-2025-27466
+CVE-2025-27466 ([This CNA information record relates to multiple CVEs; the text explai ...)
- xen <unfixed>
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
NOTE: https://xenbits.xen.org/xsa/advisory-472.html
-CVE-2025-58142
+CVE-2025-58142 ([This CNA information record relates to multiple CVEs; the text explai ...)
- xen <unfixed>
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
NOTE: https://xenbits.xen.org/xsa/advisory-472.html
-CVE-2025-58143
+CVE-2025-58143 ([This CNA information record relates to multiple CVEs; the text explai ...)
- xen <unfixed>
[bullseye] - xen <end-of-life> (EOLed in Bullseye)
NOTE: https://xenbits.xen.org/xsa/advisory-472.html
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72e1ba550e3dab2c3f42ef326124956534d7e927
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72e1ba550e3dab2c3f42ef326124956534d7e927
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250911/604c1d35/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list