[Git][security-tracker-team/security-tracker][master] Reserve DLA-4719-1 for p7zip

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a0b9eb20 by Sylvain Beucler at 2026-08-05T15:32:27+02:00
Reserve DLA-4719-1 for p7zip

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -17983,8 +17983,6 @@ CVE-2024-23564 (HCL Aftermarket EPC is affected by Business Logic Vulnerability
 CVE-2026-14266 (7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Executio ...)
 	- 7zip 26.02+dfsg-1 (bug #1142293)
 	- p7zip 16.02+transitional.1
-	[bookworm] - p7zip <postponed> (Wait for 7zip-26.02/trixie SPU approval, then backport)
-	[bullseye] - p7zip <postponed> (Wait for 7zip-26.02/trixie SPU approval, then backport)
 	NOTE: Since p7zip/16.02+transitional.1 src:p7zip is only an empty source package
 	NOTE: depending on 7zip. Mark this version as fixed version.
 	NOTE: https://www.zerodayinitiative.com/advisories/ZDI-26-444/
@@ -32134,8 +32132,6 @@ CVE-2026-58052 (7-Zip for Windows through 26.01 fails to preserve the Mark-of-th
 	- 7zip 26.02+dfsg-1
 	[trixie] - 7zip <ignored> (Only affects Windows NTFS with transparent ADS and :$DATA canonicalization, i.e. not the current ntfs-3g)
 	- p7zip 16.02+transitional.1
-	[bookworm] - p7zip <ignored> (Only affects Windows NTFS with transparent ADS and :$DATA canonicalization, i.e. not the current ntfs-3g)
-	[bullseye] - p7zip <ignored> (Only affects Windows NTFS with transparent ADS and :$DATA canonicalization, i.e. not the current ntfs-3g)
 	NOTE: Since p7zip/16.02+transitional.1 src:p7zip is only an empty source package
 	NOTE: depending on 7zip. Mark this version as fixed version.
 	NOTE: https://github.com/bikini/exploitarium/tree/main/7zip-rar5-motw-chain-poc


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,7 @@
+[05 Aug 2026] DLA-4719-1 p7zip - security update
+	{CVE-2026-14266 CVE-2026-58052}
+	[bullseye] - p7zip 16.02+really26.02+dfsg-0+deb11u1
+	[bookworm] - p7zip 16.02+really26.02+dfsg-0+deb12u1
 [05 Aug 2026] DLA-4718-1 7zip - security update
 	{CVE-2026-14266 CVE-2026-58052}
 	[bookworm] - 7zip 22.01+really26.02+dfsg-0+deb12u1


=====================================
data/dla-needed.txt
=====================================
@@ -637,10 +637,6 @@ openvswitch/bullseye
 orthanc/bullseye
   NOTE: 20260419: Added by Front-Desk (rouca)
 --
-p7zip (Sylvain Beucler)
-  NOTE: 20260718: Added by Front-Desk (Beuc)
-  NOTE: 20260718: Follow 7zip updates.
---
 pacemaker
   NOTE: 20260618: Added by Front-Desk (charles)
   NOTE: 20260618: Package is in dsa-needed (charles)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a0b9eb204b4532c2ad517d3423439698e690433f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a0b9eb204b4532c2ad517d3423439698e690433f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260805/3a5badfe/attachment.htm>