[Git][security-tracker-team/security-tracker][master] CVE-2025-28162,CVE-2025-28164,CVE-2026-22695,CVE-2026-22801: bullseye postponed

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b45cdc02 by Sylvain Beucler at 2026-01-30T11:42:18+01:00
CVE-2025-28162,CVE-2025-28164,CVE-2026-22695,CVE-2026-22801: bullseye postponed

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1103,12 +1103,14 @@ CVE-2025-33234 (NVIDIA runx contains a vulnerability where an attacker could cau
 CVE-2025-28164 (Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local a ...)
 	- libpng1.6 1.6.47-1
 	[bookworm] - libpng1.6 <no-dsa> (Minor issue)
+	[bullseye] - libpng1.6 <postponed> (Minor issue, memory leak)
 	NOTE: https://github.com/pnggroup/libpng/issues/655
 	NOTE: https://github.com/pnggroup/libpng/pull/657
 	NOTE: Fixed by: https://github.com/pnggroup/libpng/commit/b20e6fb31479868f1d5f5cd268d4776767016941 (v1.6.47)
 CVE-2025-28162 (Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local a ...)
 	- libpng1.6 1.6.47-1
 	[bookworm] - libpng1.6 <no-dsa> (Minor issue)
+	[bullseye] - libpng1.6 <postponed> (Minor issue, memory leak)
 	NOTE: https://github.com/pnggroup/libpng/issues/656
 	NOTE: https://github.com/pnggroup/libpng/pull/657
 	NOTE: Fixed by: https://github.com/pnggroup/libpng/commit/b20e6fb31479868f1d5f5cd268d4776767016941 (v1.6.47)
@@ -7402,12 +7404,14 @@ CVE-2026-22801 (LIBPNG is a reference library for use in applications that read,
 	- libpng1.6 1.6.54-1 (bug #1125444)
 	[trixie] - libpng1.6 <no-dsa> (Minor issue)
 	[bookworm] - libpng1.6 <no-dsa> (Minor issue)
+	[bullseye] - libpng1.6 <postponed> (Minor issue, OOB read)
 	NOTE: https://github.com/pnggroup/libpng/security/advisories/GHSA-vgjq-8cw5-ggw8
 	NOTE: Fixed by: https://github.com/pnggroup/libpng/commit/cf155de014fc6c5cb199dd681dd5c8fb70429072
 CVE-2026-22695 (LIBPNG is a reference library for use in applications that read, creat ...)
 	- libpng1.6 1.6.54-1 (bug #1125443)
 	[trixie] - libpng1.6 <no-dsa> (Minor issue)
 	[bookworm] - libpng1.6 <no-dsa> (Minor issue)
+	[bullseye] - libpng1.6 <postponed> (Minor issue, OOB read)
 	NOTE: https://github.com/pnggroup/libpng/security/advisories/GHSA-mmq5-27w3-rxpp
 	NOTE: Introduced by: https://github.com/pnggroup/libpng/commit/218612ddd6b17944e21eda56caf8b4bf7779d1ea (v1.6.51)
 	NOTE: Fixed by: https://github.com/pnggroup/libpng/commit/e4f7ad4ea2a471776c81dda4846b7691925d9786



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b45cdc021a552ef83fad7b25e5429ba15b490337

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b45cdc021a552ef83fad7b25e5429ba15b490337
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260130/85aeebfe/attachment.htm>