[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Thu Jul 9 07:47:47 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
e9eb03e0 by Moritz Muehlenhoff at 2026-07-09T08:47:31+02:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -133,6 +133,7 @@ CVE-2026-59937 (pypdf is a free and open-source pure-python PDF library. Prior t
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/b5fc5aa714f4b696fb9b1deaa35a9e4a4eb50dae (6.14.0)
CVE-2026-59930 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- mistune <unfixed>
+ [trixie] - mistune <no-dsa> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-2hm2-hc3v-44h9
NOTE: Fixed by: https://github.com/lepture/mistune/commit/c4093c4742ed0d10d9332fb8edb455869b7b581b (v3.3.0)
CVE-2026-59929 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
@@ -153,6 +154,7 @@ CVE-2026-59926 (Mistune is a Python Markdown parser with renderers and plugins.
NOTE: Fixed by: https://github.com/lepture/mistune/commit/a3cb6e5655308797e8be021d6c7b5bab13cbace2 (v3.2.1)
CVE-2026-59925 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
- mistune <unfixed>
+ [trixie] - mistune <no-dsa> (Minor issue)
NOTE: https://github.com/lepture/mistune/security/advisories/GHSA-4j32-57v6-6g45
NOTE: Fixed by: https://github.com/lepture/mistune/commit/5de41fb8e527004dbc363e047a3c380c9288c74f (v3.3.0)
CVE-2026-59924 (Mistune is a Python Markdown parser with renderers and plugins. Prior ...)
@@ -884,15 +886,18 @@ CVE-2026-14895 (String::Util versions before 1.36 for Perl are susceptible to a
NOTE: Fixed by: https://github.com/scottchiefbaker/String-Util/commit/f8150867aaeb8f57c59601aefb2193f2caed8745 (v1.36)
CVE-2026-14380 (DBI versions before 1.650 for Perl are vulnerable to code injection vi ...)
- libdbi-perl 1.650-1 (bug #1141667)
+ [trixie] - libdbi-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41625527/
NOTE: https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557
NOTE: Fixed by: https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259 (1.650)
CVE-2026-14739 (DBI versions before 1.650 for Perl have a heap overflow when preparsin ...)
- libdbi-perl 1.650-1 (bug #1141667)
+ [trixie] - libdbi-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41625530/
NOTE: Fixed by: https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395 (1.650)
CVE-2026-14740 (DBI versions before 1.650 for Perl read one byte out-of-bounds in prep ...)
- libdbi-perl 1.650-1 (bug #1141667)
+ [trixie] - libdbi-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41625532/
NOTE: https://github.com/perl5-dbi/dbi/security/advisories/GHSA-35f4-f8m9-w8xg
NOTE: Fixed by: https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01 (1.650)
@@ -1017,6 +1022,7 @@ CVE-2011-10043 (Module::Load versions before 0.22 for Perl allow arbitrary modul
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41608305/
CVE-2026-7017 (HTTP::Tiny versions before 0.095 for Perl forward credential headers t ...)
- libhttp-tiny-perl 0.096-1 (bug #1141638)
+ [trixie] - libhttp-tiny-perl <no-dsa> (Minor issue)
- perl <unfixed> (bug #1141639)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/41618211/
NOTE: https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36
@@ -6556,6 +6562,7 @@ CVE-2026-28979 (An out-of-bounds access issue was addressed with improved bounds
NOT-FOR-US: Apple
CVE-2026-14164 (A double free issue has been identified in libarchive's RAR5 reader. D ...)
- libarchive 3.8.8-1 (bug #1141180)
+ [trixie] - libarchive <no-dsa> (Minor issue)
NOTE: https://github.com/libarchive/libarchive/issues/3069
NOTE: https://github.com/libarchive/libarchive/pull/3071
NOTE: https://github.com/libarchive/libarchive/commit/1c914cdfef533cbee1ae3aa21a89ba02ed4d5f61 (master)
@@ -8655,15 +8662,19 @@ CVE-2026-56790 (CANBoat through 6.22, fixed in commit a5a22b7, contains an off-b
- canboat <itp> (bug #921311)
CVE-2026-56789 (RTKLIB through 2.4.3 contains a heap buffer overflow vulnerability in ...)
- rtklib <unfixed> (bug #1140766)
+ [trixie] - rtklib <no-dsa> (Minor issue)
NOTE: https://github.com/tomojitakasu/RTKLIB/issues/796
CVE-2026-56788 (RTKLIB through 2.4.3 contains an out-of-bounds read vulnerability in g ...)
- rtklib <unfixed> (bug #1140766)
+ [trixie] - rtklib <no-dsa> (Minor issue)
NOTE: https://github.com/tomojitakasu/RTKLIB/issues/797
CVE-2026-56787 (RTKLIB through 2.4.3 contains an off-by-one out-of-bounds read vulnera ...)
- rtklib <unfixed> (bug #1140766)
+ [trixie] - rtklib <no-dsa> (Minor issue)
NOTE: https://github.com/tomojitakasu/RTKLIB/issues/798
CVE-2026-56786 (RTKLIB through 2.4.3 contains an out-of-bounds write vulnerability in ...)
- rtklib <unfixed> (bug #1140766)
+ [trixie] - rtklib <no-dsa> (Minor issue)
NOTE: https://github.com/tomojitakasu/RTKLIB/issues/799
CVE-2026-56779 (MaxKB before 2.10.0 contains a server-side request forgery vulnerabili ...)
NOT-FOR-US: MaxKB
@@ -10403,6 +10414,7 @@ CVE-2026-54686 (Warp is an agentic development environment. From 0.2021.04.25.23
NOT-FOR-US: Warp
CVE-2026-54297 (Faraday is an HTTP client library abstraction layer that provides a co ...)
- ruby-faraday 2.14.3-1
+ [trixie] - ruby-faraday <no-dsa> (Minor issue)
NOTE: https://github.com/lostisland/faraday/security/advisories/GHSA-98m9-hrrm-r99r
CVE-2026-53950 (@tryghost/activitypub is Ghost\u2019s social/federation client app. Pr ...)
NOT-FOR-US: tryghost/activitypub
@@ -43985,8 +43997,12 @@ CVE-2026-40174 (Masa CMS is a content management system forked from Mura CMS. In
NOT-FOR-US: Masa CMS
CVE-2026-40171 (In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions ...)
- jupyter-notebook <unfixed>
+ [trixie] - jupyter-notebook <not-affected> (Vulnerable code not present, introduced in 7.0)
+ [bookworm] - jupyter-notebook <not-affected> (Vulnerable code not present, introduced in 7.0)
+ [bullseye] - jupyter-notebook <not-affected> (Vulnerable code not present, introduced in 7.0)
- jupyterlab <unfixed>
NOTE: https://github.com/jupyter/notebook/security/advisories/GHSA-rch3-82jr-f9w9
+ NOTE: https://github.com/jupyter/notebook/commit/50e5222c9670121c3369900c7dce01aae53823fc
CVE-2026-40076 (OpenMRS Core is an open source electronic medical record system platfo ...)
NOT-FOR-US: OpenMRS
CVE-2026-40004 (There exists an openssl.cnf privilege escalation vulnerability in ZTE ...)
=====================================
data/dsa-needed.txt
=====================================
@@ -115,6 +115,8 @@ rust-wasmtime
--
shaarli
--
+starlette
+--
tomcat10
--
tomcat11
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e9eb03e0cb798c94f13d7cbeeeff13f83b48402e
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e9eb03e0cb798c94f13d7cbeeeff13f83b48402e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260709/4179e3e0/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list