[Git][security-tracker-team/security-tracker][master] Reserve DLA-4492-1 for gnutls28

[Guilhem Moulin (@guilhem)]

Guilhem Moulin pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9acff15f by Guilhem Moulin at 2026-02-25T10:05:09+01:00
Reserve DLA-4492-1 for gnutls28

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -993,7 +993,7 @@ CVE-2025-61146 (saitoha libsixel until v1.8.7 was discovered to contain a memory
 	NOTE: https://github.com/saitoha/libsixel/issues/207
 	NOTE: https://github.com/saitoha/libsixel/commit/e0ba6685262a3679cc5b9009c0c5b7dc8a3f262e
 CVE-2025-61145 (libtiff up to v4.7.1 was discovered to contain a double free via the c ...)
-	- tiff 4.7.1-1  (unimportant)
+	- tiff 4.7.1-1 (unimportant)
 	NOTE: https://gitlab.com/libtiff/libtiff/-/issues/736
 	NOTE: https://gitlab.com/libtiff/libtiff/-/merge_requests/753
 	NOTE: Fixed by: https://gitlab.com/libtiff/libtiff/-/commit/0ac97aa7a5bffddd88f7cdbe517264e9db3f5bd5 (v4.7.1rc1)
@@ -39697,7 +39697,6 @@ CVE-2025-9820 (A flaw was found in the GnuTLS library, specifically in the gnutl
 	- gnutls28 3.8.11-3 (bug #1121146)
 	[trixie] - gnutls28 3.8.9-3+deb13u1
 	[bookworm] - gnutls28 3.7.9-2+deb12u6
-	[bullseye] - gnutls28 <postponed> (Minor issue; can be fixed in next update)
 	NOTE: https://www.gnutls.org/security-new.html#GNUTLS-SA-2025-11-18
 	NOTE: https://gitlab.com/gnutls/gnutls/-/issues/1732
 	NOTE: Fixed by: https://gitlab.com/gnutls/gnutls/-/commit/1d56f96f6ab5034d677136b9d50b5a75dff0faf5 (3.8.11)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[25 Feb 2026] DLA-4492-1 gnutls28 - security update
+	{CVE-2025-9820 CVE-2025-14831}
+	[bullseye] - gnutls28 3.7.1-5+deb11u9
 [23 Feb 2026] DLA-4491-1 glib2.0 - security update
 	{CVE-2026-0988 CVE-2026-1484 CVE-2026-1485 CVE-2026-1489}
 	[bullseye] - glib2.0 2.66.8-1+deb11u8


=====================================
data/dla-needed.txt
=====================================
@@ -136,9 +136,6 @@ glib2.0 (ah)
   NOTE: 20260223: This issue already handled in LTS/DLA, but
   NOTE: 20260223: waiting for SPU/OSPU to be done before dropping this! (ah)
 --
-gnutls28 (guilhem)
-  NOTE: 20260216: Added by Front-Desk (utkarsh)
---
 golang-github-gorilla-csrf
   NOTE: 20250422: Added by Front-Desk (rouca)
   NOTE: 20250422: Need to binNMU reverse depends (in that order): golang-github-alecthomas-chroma, golang-github-niklasfasching-go-org, golang-github-yuin-goldmark-highlighting, hugo (rouca)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9acff15fa96134aac03dc9f05aaf9bb49c3b8e17

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9acff15fa96134aac03dc9f05aaf9bb49c3b8e17
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260225/ef5198d9/attachment.htm>