[Git][security-tracker-team/security-tracker][master] 17 commits: lts: aom not-affected in bullseye (encoder code absent in 1.0.0)
Utkarsh Gupta (@utkarsh)
utkarsh at debian.org
Fri Jul 10 06:04:42 BST 2026
Utkarsh Gupta pushed to branch master at Debian Security Tracker / security-tracker
Commits:
330f829b by Utkarsh Gupta at 2026-07-10T03:43:39+05:30
lts: aom not-affected in bullseye (encoder code absent in 1.0.0)
- - - - -
4715fe33 by Utkarsh Gupta at 2026-07-10T03:43:41+05:30
lts: jackson-databind not-affected in bullseye/bookworm
for CVE-2026-54516/54517/54518 and bookworm for CVE-2026-50193
(version ranges)
- - - - -
84b31295 by Utkarsh Gupta at 2026-07-10T03:43:43+05:30
lts: gimp not-affected in bullseye/bookworm
for CVE-2026-59089 (TIM loader is GIMP 3.x only)
- - - - -
92295090 by Utkarsh Gupta at 2026-07-10T03:43:43+05:30
dla-needed: add aom
- - - - -
5b65bba4 by Utkarsh Gupta at 2026-07-10T03:43:43+05:30
dla-needed: add gimp
- - - - -
6efba0c6 by Utkarsh Gupta at 2026-07-10T03:43:43+05:30
dla-needed: add jackson-databind
- - - - -
26566560 by Utkarsh Gupta at 2026-07-10T03:43:43+05:30
dla-needed: add libde265
- - - - -
6fb81527 by Utkarsh Gupta at 2026-07-10T03:43:43+05:30
dla-needed: add libxfont
- - - - -
74a65212 by Utkarsh Gupta at 2026-07-10T03:43:43+05:30
dla-needed: add opam
- - - - -
9b624d25 by Utkarsh Gupta at 2026-07-10T03:43:43+05:30
dla-needed: add py7zr
- - - - -
c17f947e by Utkarsh Gupta at 2026-07-10T03:43:43+05:30
dla-needed: add python-authlib
- - - - -
ebac7c37 by Utkarsh Gupta at 2026-07-10T03:43:43+05:30
dla-needed: add python-httplib2
- - - - -
96414811 by Utkarsh Gupta at 2026-07-10T03:43:44+05:30
dla-needed: add python-msgpack
- - - - -
5f8b1253 by Utkarsh Gupta at 2026-07-10T03:43:44+05:30
dla-needed: add roundcube
- - - - -
3367e960 by Utkarsh Gupta at 2026-07-10T03:43:44+05:30
dla-needed: add ruby-oj
- - - - -
6ffb7f54 by Utkarsh Gupta at 2026-07-10T03:43:44+05:30
dla-needed: add tiff
- - - - -
f54b8e1b by Utkarsh Gupta at 2026-07-10T03:43:44+05:30
Wrap lines wherever appropriate
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -2068,6 +2068,8 @@ CVE-2026-45094
NOTE: Fixed by: https://github.com/eProsima/Fast-DDS/commit/d9f4b373c90179c96f3b1542e72f16e282ef0104 (v3.6.2)
CVE-2026-59089 (A flaw was found in GIMP. The PlayStation TIM loader, responsible for ...)
- gimp <unfixed>
+ [bullseye] - gimp <not-affected> (PlayStation TIM loader plug-ins/common/file-tim.c added in GIMP 3.x; 2.10 has no such loader)
+ [bookworm] - gimp <not-affected> (PlayStation TIM loader plug-ins/common/file-tim.c added in GIMP 3.x; 2.10 has no such loader)
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16493
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/53cdb27fa2b1676d11e9677c9975b5ad7b61b2ee
CVE-2026-XXXX [GHSA-jv8r-gqr9-68wj: Memory-amplification denial of service via unvalidated DNS header record counts]
@@ -12474,6 +12476,8 @@ CVE-2026-54555 (rtk filters and compresses command outputs before they reach you
NOT-FOR-US: rtk-ai rtk
CVE-2026-54518 (jackson-databind contains the general-purpose data-binding functionali ...)
- jackson-databind <unfixed>
+ [bullseye] - jackson-databind <not-affected> (introduced in 2.21.0; bullseye ships 2.12)
+ [bookworm] - jackson-databind <not-affected> (introduced in 2.21.0; bookworm ships 2.14)
NOTE: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-rcqc-6cw3-h962
NOTE: https://github.com/FasterXML/jackson-databind/pull/5971
NOTE: https://github.com/FasterXML/jackson-databind/pull/5973
@@ -12481,6 +12485,8 @@ CVE-2026-54518 (jackson-databind contains the general-purpose data-binding funct
NOTE: https://github.com/FasterXML/jackson-databind/commit/d633bc038f200c1397c07f1a2b46f58e72c91eea (jackson-databind-3.1.4)
CVE-2026-54517 (jackson-databind contains the general-purpose data-binding functionali ...)
- jackson-databind <unfixed>
+ [bullseye] - jackson-databind <not-affected> (introduced in 2.21.0; bullseye ships 2.12)
+ [bookworm] - jackson-databind <not-affected> (introduced in 2.21.0; bookworm ships 2.14)
NOTE: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-5hh8-q8hv-fr38
NOTE: https://github.com/FasterXML/jackson-databind/pull/5969
NOTE: https://github.com/FasterXML/jackson-databind/pull/5970
@@ -12488,6 +12494,8 @@ CVE-2026-54517 (jackson-databind contains the general-purpose data-binding funct
NOTE: https://github.com/FasterXML/jackson-databind/commit/5bf23edb4221f7dd2ec8e71ff6d26c61640f261d (jackson-databind-3.1.4)
CVE-2026-54516 (jackson-databind contains the general-purpose data-binding functionali ...)
- jackson-databind <unfixed>
+ [bullseye] - jackson-databind <not-affected> (introduced in 2.21.0; bullseye ships 2.12)
+ [bookworm] - jackson-databind <not-affected> (introduced in 2.21.0; bookworm ships 2.14)
NOTE: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-9fxm-vc8v-hj55
NOTE: https://github.com/FasterXML/jackson-databind/pull/5967
NOTE: https://github.com/FasterXML/jackson-databind/pull/5968
@@ -12541,6 +12549,7 @@ CVE-2026-53622 (Traefik is an HTTP reverse proxy and load balancer. Prior to 3.7
- traefik <itp> (bug #983289)
CVE-2026-50193 (jackson-databind contains the general-purpose data-binding functionali ...)
- jackson-databind <unfixed>
+ [bookworm] - jackson-databind <not-affected> (fixed upstream in 2.14.0; bookworm ships 2.14.0)
NOTE: https://github.com/FasterXML/jackson-databind/security/advisories/GHSA-3wrr-7qpf-2prh
NOTE: https://github.com/FasterXML/jackson-databind/issues/3447
NOTE: Fixed by: https://github.com/FasterXML/jackson-databind/commit/a1fa4ae4ecf5cee16da465985f135f3e81816f8c (jackson-databind-2.14.0-rc1)
@@ -14292,21 +14301,25 @@ CVE-2026-6798 (The 2Download Connector for 2DL Hosted Checkout plugin for WordPr
NOT-FOR-US: WordPress plugin
CVE-2026-56211 (A remote code execution vulnerability was found in libaom, the referen ...)
- aom <unfixed> (bug #1140428)
+ [bullseye] - aom <not-affected> (1.0.0 lacks the aom_svc_layer_id_t encoder control, introduced in 2.0.0)
NOTE: https://aomedia.googlesource.com/aom/+/a93ba0ffaacd5f576a241bf739110e65287e516d
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2490802
NOTE: https://issues.chromium.org/issues/503993985
CVE-2026-56210 (A heap-buffer-overflow read vulnerability was found in libaom, the ref ...)
- aom <unfixed> (bug #1140428)
+ [bullseye] - aom <not-affected> (1.0.0 lacks the SVC encoder layer_context array, introduced in 2.0.0)
NOTE: https://aomedia.googlesource.com/aom/+/a93ba0ffaacd5f576a241bf739110e65287e516d
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2490801
NOTE: https://issues.chromium.org/issues/503975732
CVE-2026-56209 (An arbitrary address write vulnerability was found in libaom, the refe ...)
- aom <unfixed> (bug #1140428)
+ [bullseye] - aom <not-affected> (1.0.0 lacks the aom_svc_layer_id_t encoder control, introduced in 2.0.0)
NOTE: https://aomedia.googlesource.com/aom/+/a93ba0ffaacd5f576a241bf739110e65287e516d
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2490800
NOTE: https://issues.chromium.org/issues/503993984
CVE-2026-56208 (A heap buffer overflow vulnerability was found in libaom, the referenc ...)
- aom <unfixed> (bug #1140428)
+ [bullseye] - aom <not-affected> (1.0.0 lacks LAP two-pass mode (encoder), introduced upstream in 2.0.0)
NOTE: https://aomedia.googlesource.com/aom/+/243f8ae84bfbc495b3a3c12948abc4dff3af2f84
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2490799
NOTE: https://issues.chromium.org/issues/504317456
=====================================
data/dla-needed.txt
=====================================
@@ -65,6 +65,11 @@ amd64-microcode
ansible
NOTE: 20260611: Added by Front-Desk (rouca)
--
+aom/bookworm
+ NOTE: 20260709: Added by Front-Desk (utkarsh)
+ NOTE: 20260709: AV1 *encoder* flaws (SVC layer-id/LAP), CVE-2026-56208..56211; only
+ NOTE: 20260709: bookworm (3.6.0) affected, bullseye not-affected (code added in aom 2.0.0).
+--
apache-directory-api
NOTE: 20260608: Added by Front-Desk (rouca)
--
@@ -163,9 +168,11 @@ expat
--
ffmpeg/bullseye
NOTE: 20260710: Added by Front-Desk (utkarsh)
- NOTE: 20260710: CVE-2026-12706: heap UAF in RASC decoder. Fixed in bookworm/trixie/sid (DSA-6276-1/DSA-6268-1, upstream n5.1.9/n7.1.4).
- NOTE: 20260710: Backport upstream 0db9de2219a4 (5.1 branch) onto 4.3.9; 4.3/4.1 branches EOL upstream.
- NOTE: 20260710: Consider batching open CVE-2026-8461 (fixed n5.1.10) + postponed minors; watch CVE-2026-58049 (RASC, public PoC, unfixed upstream).
+ NOTE: 20260710: CVE-2026-12706: heap UAF in RASC decoder. Fixed in bookworm/trixie/sid
+ NOTE: 20260710: (DSA-6276-1/DSA-6268-1, upstream n5.1.9/n7.1.4).
+ NOTE: 20260710: Backport upstream 0db9de2219a4 (5.1 branch) onto 4.3.9; 4.3/4.1 branches
+ NOTE: 20260710: EOL upstream. Consider batching open CVE-2026-8461 (fixed n5.1.10) +
+ NOTE: 20260710: postponed minors; watch CVE-2026-58049 (RASC, public PoC, unfixed upstream).
--
firebird3.0
NOTE: 20260418: Added by Front-Desk (rouca)
@@ -196,6 +203,11 @@ gh/bookworm
NOTE: 20241230: Added by Security Team (carnil)
NOTE: 20260611: bookworm LTS handover.
--
+gimp
+ NOTE: 20260709: Added by Front-Desk (utkarsh)
+ NOTE: 20260709: PSP/PNM/PSD parser overflows CVE-2026-58379..58388 (crafted image); TIM-loader
+ NOTE: 20260709: CVE-2026-59089 not-affected (GIMP 3.x-only).
+--
glances/bullseye
NOTE: 20260518: Added by Front-Desk (Beuc)
NOTE: 20260518: Many postponed vulnerabilities piled-up (Beuc/front-desk)
@@ -275,6 +287,11 @@ isc-kea/bookworm
NOTE: 20260224: Added by Security Team (jmm)
NOTE: 20260611: bookworm LTS handover.
--
+jackson-databind
+ NOTE: 20260709: Added by Front-Desk (utkarsh)
+ NOTE: 20260709: CVE-2026-54512/54513/54514/54515 hit 2.12(bullseye)+2.14(bookworm);
+ NOTE: 20260709: 54516/54517/54518 (>=2.21) and 50193 (bookworm 2.14) not-affected.
+--
jetty9
NOTE: 20260418: Added by Front-Desk. Fix CVE-2026-5795 maybe other (rouca)
--
@@ -317,6 +334,11 @@ libcrypt-pbkdf2-perl
libcryptx-perl/bullseye
NOTE: 20260531: Added by Front-Desk (dleidert)
--
+libde265
+ NOTE: 20260709: Added by Front-Desk (utkarsh)
+ NOTE: 20260709: HEVC decoder overflow/UAF (CVE-2026-45382/45383/49295/49337/49346/54240/54241);
+ NOTE: 20260709: upstream fixes v1.0.19-v1.1.1 newer than Debian 1.0.11.
+--
libheif
NOTE: 20260612: Added by Front-Desk (rouca)
--
@@ -387,6 +409,11 @@ libstb/bullseye
libvncserver
NOTE: 20260612: Added by Front-Desk (rouca)
--
+libxfont
+ NOTE: 20260709: Added by Front-Desk (utkarsh)
+ NOTE: 20260709: PCF/bitmap font-parser heap overflows CVE-2026-56001/56002/56003
+ NOTE: 20260709: (fixed libXfont2-2.0.8); Debian <=2.0.6. oss-sec 2026-07-08.
+--
libxmltok/bullseye
NOTE: 20250421: Added by Front-Desk (ta)
NOTE: 20250421: Also review all other expat CVEs. (bunk)
@@ -486,6 +513,10 @@ nvidia-graphics-drivers/bullseye
ocaml/bullseye
NOTE: 20260419: Added by Front-Desk (rouca)
--
+opam
+ NOTE: 20260709: Added by Front-Desk (utkarsh)
+ NOTE: 20260709: CVE-2026-57825 symlink switch-prefix bypass (opamAction.ml); affects 2.x incl. bullseye/bookworm.
+--
openexr/bullseye
NOTE: 20260413: Added by Front-Desk (rouca)
--
@@ -545,6 +576,10 @@ prosody/bullseye
NOTE: 20260511: Added by Front-Desk (dleidert)
NOTE: 20260511: Follow DSA 6252-1 fixing 4 CVEs (dleidert/front-desk)
--
+py7zr
+ NOTE: 20260709: Added by Front-Desk (utkarsh)
+ NOTE: 20260709: CVE-2026-23879 (GHSA range <=1.1.2); Debian 0.11.3 in range.
+--
pypdf2/bullseye (dleidert)
NOTE: 20260328: Added by Front-Desk (Beuc)
NOTE: 20260328: 6 new CVEs, and lots of postponed issues piled-up (Beuc/front-desk)
@@ -553,6 +588,18 @@ python-aiohttp (dleidert)
NOTE: 20260611: Added by Front-Desk (rouca)
NOTE: 20260602: Daniel Leidert is proposing to work on the update and provide debdiffs for bookworm and trixie (carnil)
--
+python-authlib
+ NOTE: 20260709: Added by Front-Desk (utkarsh)
+ NOTE: 20260709: CVE-2026-41479 (<1.6.10) + CVE-2026-44681 (<=1.6.11); Debian 0.15.4/1.2.0 in range.
+--
+python-httplib2
+ NOTE: 20260709: Added by Front-Desk (utkarsh)
+ NOTE: 20260709: CVE-2026-59939 (fixed 0.32.0); Debian <=0.20.4 affected.
+--
+python-msgpack
+ NOTE: 20260709: Added by Front-Desk (utkarsh)
+ NOTE: 20260709: CVE-2026-57585 (fixed 1.2.1; <=1.2.0 affected); Debian 1.0.x.
+--
python-oslo.messaging/bullseye
NOTE: 20260612: Added by Front-Desk (rouca)
--
@@ -578,11 +625,20 @@ request-tracker4/bullseye (Andrew Ruthven)
NOTE: 20260529: Follow DSA in preparation by maintainer (dleidert/front-desk)
NOTE: 20260607: Andrew Ruthven (maintainer) is working on a DLA.
--
+roundcube
+ NOTE: 20260709: Added by Front-Desk (utkarsh)
+ NOTE: 20260709: Zero-click stored XSS CVE-2026-54432/54433 (fixed 1.6.17) +
+ NOTE: 20260709: TEMP-1141495-* (4); bullseye+bookworm.
+--
rsync (Thorsten Alteholz)
NOTE: 20260615: Added by Front-Desk (charles)
NOTE: 20260615: Requested by Sylvain to track regressions, same as in dsa-needed. (charles)
NOTE: 20260705: making progress with updated patches
--
+ruby-oj
+ NOTE: 20260709: Added by Front-Desk (utkarsh)
+ NOTE: 20260709: Oj JSON parser memory-safety batch CVE-2026-54500..54903 (GHSA); affects 2.17-3.14.
+--
ruby-rack (Abhijith PA)
NOTE: 20260413: Added by Front-Desk (rouca)
NOTE: 20260608: https://people.debian.org/~abhijith/upload/rr/ (abhijith)
@@ -660,6 +716,11 @@ symfony/bullseye
NOTE: 20260521: at least 1 SQLI and 1 stored XSS.
NOTE: 20260521: Upcoming DSA (Beuc/front-desk)
--
+tiff
+ NOTE: 20260709: Added by Front-Desk (utkarsh)
+ NOTE: 20260709: CVE-2026-12912 (fixed 4.7.2rc2) + CVE-2026-36849 (read-buffer alloc);
+ NOTE: 20260709: read-path, both suites.
+--
trafficserver/bullseye
NOTE: 20241120: Added by Front-Desk (Beuc)
NOTE: 20241120: Upcoming DSA (Beuc/front-desk)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/8b698ab428671c5704fc64b8c9e9e555cb96f476...f54b8e1bd1f8d55f472c86fb9dd7adaef8244af9
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/8b698ab428671c5704fc64b8c9e9e555cb96f476...f54b8e1bd1f8d55f472c86fb9dd7adaef8244af9
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260710/7fb45550/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list