[Git][security-tracker-team/security-tracker][master] 4 commits: lts: update erlang to cover Bookworm as well

[Daniel Leidert (@dleidert)]

Daniel Leidert pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a1f042b1 by Daniel Leidert at 2026-07-03T03:38:06+02:00
lts: update erlang to cover Bookworm as well

- - - - -
73972136 by Daniel Leidert at 2026-07-03T03:38:30+02:00
lts: update firebird3.0 entry to cover Bookworm as well

- - - - -
ec95ba60 by Daniel Leidert at 2026-07-03T03:50:39+02:00
lts: add node-lodash/bookworm to dla-needed

- - - - -
c19682a3 by Daniel Leidert at 2026-07-03T04:02:38+02:00
Add patch link for CVE-2026-43958/rrdtool

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -23012,6 +23012,7 @@ CVE-2026-44211 (Cline is an autonomous coding agent as an SDK, IDE extension, or
 CVE-2026-43958 (A flaw was found in rrdcached, a component of rrdtool. A local attacke ...)
 	- rrdtool <unfixed> (bug #1140106)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2460932
+	NOTE: Fixed by: https://github.com/oetiker/rrdtool-1.x/commit/4218ec7127ba6c7ea1c20d7c8ea6e2b3f83df73a (v1.10.0)
 CVE-2026-43625 (CodexBar prior to 0.32.0 contains a session cookie leakage vulnerabili ...)
 	NOT-FOR-US: CodexBar
 CVE-2026-43624 (F5-TTS through version 1.1.20 contains a path traversal vulnerability  ...)


=====================================
data/dla-needed.txt
=====================================
@@ -151,20 +151,22 @@ edk2/bullseye
   NOTE: 20251230: Added by Front-Desk (Beuc)
   NOTE: 20251230: Lots of postponed issues piled-up (Beuc/front-desk)
 --
-erlang/bullseye
+erlang
   NOTE: 20260519: Added by Front-Desk (Beuc)
   NOTE: 20260519: Re-added after DLA-4590-1, due to 3 newer CVEs, some of which high.
   NOTE: 20260519: Also fully follow bookworm 12.14 (CVE-2025-48040)
   NOTE: 20260519: and bookworm 12.12 (CVE-2025-46712).
   NOTE: 20260519: Fix ELTS at the same time. (Beuc/front-desk)
+  NOTE: 20260702: Another round of issues and upcoming DSA (dleidert/front-desk)
 --
 expat
   NOTE: 20260518: Added by Front-Desk (Beuc)
   NOTE: 20260518: Upcoming DSA + many postponed CVE.
   NOTE: 20260518: CVE-2026-41080 fix requires for python's CVE-2026-7210.
 --
-firebird3.0/bullseye
+firebird3.0
   NOTE: 20260418: Added by Front-Desk (rouca)
+  NOTE: 20260702: Upcoming DSA (dleidert/front-desk)
 --
 firmware-nonfree/bullseye
   NOTE: 20251130: Added by Front-Desk. Moreover, take care of postponed issue (rouca)
@@ -456,6 +458,10 @@ nginx (charles)
   NOTE: 20260618: There was also a customer request to fix it. (charles)
   NOTE: 20260630: Bullseye fix release with 2 CVE fixes + http2 bomb fix. Bookworm coming soon. (charles)
 --
+node-lodash/bookworm (utkarsh)
+  NOTE: 20260703: Added by Front-Desk (dleidert)
+  NOTE: 20260703: Follow DLA 4663-1; assigned to Utkarsh to grab this (dleidert/front-desk)
+--
 nodejs
   NOTE: 20260622: Added by Front-Desk (lamby)
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/d5b0f1030590194e9c8fbe9076ffac26c17efdf6...c19682a3cef80ef11ba273b9a87ef5ffc3a2cf11

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/d5b0f1030590194e9c8fbe9076ffac26c17efdf6...c19682a3cef80ef11ba273b9a87ef5ffc3a2cf11
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260703/71feaaac/attachment-0001.htm>