[Git][security-tracker-team/security-tracker][master] 6 commits: CVE-2025-46728,CVE-2025-53629/cpp-httplib: bookworm postponed
Sylvain Beucler (@beuc)
gitlab at salsa.debian.org
Tue Jul 14 16:36:45 BST 2026
Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker
Commits:
d86dd7a5 by Sylvain Beucler at 2026-07-14T17:36:30+02:00
CVE-2025-46728,CVE-2025-53629/cpp-httplib: bookworm postponed
- - - - -
0bc82168 by Sylvain Beucler at 2026-07-14T17:36:31+02:00
dcmtk: bookworm,bullseye postponed
- - - - -
69880d4e by Sylvain Beucler at 2026-07-14T17:36:31+02:00
lts: reference wolfssl/bookworm upstream discussion
- - - - -
8191a237 by Sylvain Beucler at 2026-07-14T17:36:32+02:00
lts: drop zulucrypt
EOL'd
https://lists.debian.org/debian-lts-announce/2026/07/msg00000.html
https://salsa.debian.org/debian/debian-security-support/-/merge_requests/67
- - - - -
cc4fee25 by Sylvain Beucler at 2026-07-14T17:36:33+02:00
wolfssl: bullseye postponed
- - - - -
e044ae33 by Sylvain Beucler at 2026-07-14T17:36:33+02:00
lts: add php-horde-imp
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -7237,6 +7237,8 @@ CVE-2026-54500 (Oj (Optimized JSON) is a JSON parser and Object marshaller packa
CVE-2026-52868 (An unauthenticated attacker can read worklist records from a directory ...)
- dcmtk 3.7.0+really3.7.0-7 (bug #1141411)
[trixie] - dcmtk <no-dsa> (Minor issue; exposing first in unstable, then via proposed-updates)
+ [bookworm] - dcmtk <postponed> (Minor issue; follow SPU)
+ [bullseye] - dcmtk <postponed> (Minor issue; follow SPU)
NOTE: Fixed by: https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=e3878daf870cd2db50eadfde38615f0afae8a584
CVE-2026-52198 (Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-1613 ...)
NOT-FOR-US: UTT
@@ -7251,6 +7253,8 @@ CVE-2026-52193 (Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-21091
CVE-2026-50254 (An unauthenticated remote attacker can repeatedly send a single crafte ...)
- dcmtk 3.7.0+really3.7.0-7 (bug #1141411)
[trixie] - dcmtk <no-dsa> (Minor issue; exposing first in unstable, then via proposed-updates)
+ [bookworm] - dcmtk <postponed> (Minor issue; follow SPU)
+ [bullseye] - dcmtk <postponed> (Minor issue; follow SPU)
NOTE: Fixed by: https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=23f181f7a3cb8334056f751a3a0c2ddf01046752
CVE-2026-50110 (Storage Concentrator (SC & SCVM) contains hardcoded credentials for nu ...)
NOT-FOR-US: Storage Concentrator
@@ -7259,10 +7263,14 @@ CVE-2026-50040 (Storage Concentrator (SC & SCVM) is vulnerable to reflected cros
CVE-2026-50003 (A malicious or compromised server can make a DCMTK client using bit-pr ...)
- dcmtk 3.7.0+really3.7.0-7 (bug #1141411)
[trixie] - dcmtk <no-dsa> (Minor issue; exposing first in unstable, then via proposed-updates)
+ [bookworm] - dcmtk <postponed> (Minor issue; follow SPU)
+ [bullseye] - dcmtk <postponed> (Minor issue; follow SPU)
NOTE: Fixed by: https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=eca9a03dda7d4fc1faa7e5a6dac9617938cf5803
CVE-2026-44628 (An unauthenticated attacker can crash the worklist server with a singl ...)
- dcmtk 3.7.0+really3.7.0-7 (bug #1141411)
[trixie] - dcmtk <no-dsa> (Minor issue; exposing first in unstable, then via proposed-updates)
+ [bookworm] - dcmtk <postponed> (Minor issue; follow SPU)
+ [bullseye] - dcmtk <postponed> (Minor issue; follow SPU)
NOTE: Fixed by: https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=f4e0074682645b1a4289d62581926c4394d5c6d5
NOTE: Fixed by: https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=694a0a06a38015ce768fa161a62b148189f84959
CVE-2026-44042 (UltraVNC repeater through 1.8.2.2 contains an off-by-one error in the ...)
@@ -7279,6 +7287,8 @@ CVE-2026-37106 (An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remot
CVE-2026-35505 (An unauthenticated remote attacker can repeatedly send crafted connect ...)
- dcmtk 3.7.0+really3.7.0-7 (bug #1141411)
[trixie] - dcmtk <no-dsa> (Minor issue; exposing first in unstable, then via proposed-updates)
+ [bookworm] - dcmtk <postponed> (Minor issue; follow SPU)
+ [bullseye] - dcmtk <postponed> (Minor issue; follow SPU)
NOTE: Fixed by: https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=2312891a8d058c862e00bcbd636e5da26308658a
CVE-2026-2387 (The Event Organiser plugin for WordPress is vulnerable to Stored Cross ...)
NOT-FOR-US: WordPress plugin
@@ -11267,6 +11277,7 @@ CVE-2026-8720 (wc_Blake2bHmacFinal and wc_Blake2sHmacFinal discard the message w
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10447 (v5.9.2-stable)
CVE-2026-8661 (Server-Side Cross-Site Scripting and Server-Side Request Forgery vulne ...)
NOT-FOR-US: Rapid7
@@ -11276,71 +11287,85 @@ CVE-2026-7532 (iPAddress name constraints bypass when WOLFSSL_IP_ALT_NAME is not
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10354 (v5.9.2-stable)
CVE-2026-7531 (Use-after-free in PQC hybrid key-share handling. This is an incomplete ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10327 (v5.9.2-stable)
CVE-2026-7511 (PKCS7_verify signer confusion allows forged signatures, where the sign ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10203 (v5.9.2-stable)
CVE-2026-6731 (X.509 name constraint bypass via the Subject Common Name when treated ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10223 (v5.9.2-stable)
CVE-2026-6681 (The PKCS#7 decode path ignores the caller-supplied output buffer size ...)
- wolfssl 5.9.2-1
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10116 (v5.9.1-stable)
CVE-2026-6679 (A heap buffer overflow could occur in the DTLS 1.3 ACK serialization p ...)
- wolfssl 5.9.2-1
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10116 (v5.9.1-stable)
CVE-2026-6678 (Integer underflow in wc_PKCS7_DecryptOri when handling crafted Other R ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10203 (v5.9.2-stable)
CVE-2026-6450 (A CRL critical extension bypass exists in ParseCRL_Extensions where cr ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10239 (v5.9.2-stable)
CVE-2026-6412 (Certificate policy and RFC 8446 compliance concerns regarding the cont ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10222 (v5.9.2-stable)
CVE-2026-6331 (HMAC zero-length tag forgery in EVP_DigestVerifyFinal, where a zero-le ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10192 (v5.9.2-stable)
CVE-2026-6330 (The ML-KEM ARM64 NEON ciphertext comparison only compares half of the ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10192 (v5.9.2-stable)
CVE-2026-6329 (PKCS#12 MAC verification uses an attacker-controlled comparison length ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10192 (v5.9.2-stable)
CVE-2026-6325 (Out-of-bounds write in SetSuitesHashSigAlgo when processing an oversiz ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10204 (v5.9.2-stable)
CVE-2026-6092 (When HAVE_ENCRYPT_THEN_MAC is configured, the implementation could fal ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10167 (v5.9.2-stable)
CVE-2026-57522 (Bitwarden Server before 2026.5.0 contains a JSON injection vulnerabili ...)
- bitwarden <itp> (bug #956836)
@@ -11354,21 +11379,25 @@ CVE-2026-55964 (Chain intermediate CA:TRUE without keyCertSign accepted as a sig
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10702 (v5.9.2-stable)
CVE-2026-55962 (TLS 1.3 post-handshake authentication (PHA) issue where a server could ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10702 (v5.9.2-stable)
CVE-2026-55960 (Un-negotiated Raw Public Key (RFC 7250) accepted in place of an X.509 ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10702 (v5.9.2-stable)
CVE-2026-55958 (Out-of-bounds write in the Renesas TSIP TLS 1.3 transcript buffer. In ...)
- wolfssl 5.9.2-1 (bug #1140815)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10705 (v5.9.2-stable)
CVE-2026-54479 (The WebSocket backend uses charging station identifiers to uniquely as ...)
NOT-FOR-US: Evoke
@@ -11627,16 +11656,19 @@ CVE-2026-6291 (Bleichenbacher padding oracle in PKCS#7 KTRI decryption. When dec
- wolfssl 5.9.2-1 (bug #1140765)
[trixie] - wolfssl <no-dsa> (Can be fixed in point release)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10203 (v5.9.2-stable)
CVE-2026-6094 (Heap buffer overread in wc_PKCS7_DecodeEnvelopedData when parsing craf ...)
- wolfssl 5.9.2-1 (bug #1140765)
[trixie] - wolfssl <no-dsa> (Can be fixed in point release)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10128 (v5.9.2-stable)
CVE-2026-6091 (Partial-chain certificate verification may accept chains that terminat ...)
- wolfssl 5.9.2-1 (bug #1140765)
[trixie] - wolfssl <no-dsa> (Can be fixed in point release)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10170 (v5.9.2-stable)
CVE-2026-57700 (Unrestricted Upload of File with Dangerous Type vulnerability in Daan. ...)
NOT-FOR-US: WordPress plugin or theme
@@ -11826,11 +11858,13 @@ CVE-2026-55967 (AES-GCM encryption/decryption with extremely large cumulative si
- wolfssl 5.9.2-1 (bug #1140765)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10709 (v5.9.2-stable)
CVE-2026-55961 (wolfSSL_PKCS7_verify() returning success for a degenerate (certs-only) ...)
- wolfssl 5.9.2-1 (bug #1140765)
[trixie] - wolfssl <no-dsa> (Minor issue)
[bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
+ [bullseye] - wolfssl <postponed> (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10702 (v5.9.2-stable)
CVE-2026-55895 (Vim is an open source, command line text editor. Prior to 9.2.0663, a ...)
- vim 2:9.2.0782-1 (bug #1140775)
@@ -16385,6 +16419,7 @@ CVE-2026-12805 (A flaw has been found in OFFIS DCMTK up to 3.7.0. The affected e
- dcmtk 3.7.0+really3.7.0-6 (bug #1140562)
[trixie] - dcmtk 3.6.9-5+deb13u2
[bookworm] - dcmtk 3.6.7-9~deb12u4
+ [bullseye] - dcmtk <postponed> (Minor issue, OOB read)
NOTE: https://support.dcmtk.org/redmine/issues/1208
NOTE: Fixed by: https://git.dcmtk.org/?p=dcmtk.git;a=commit;h=1d4b3815c0987840a983160bfc671fef63a3105b
CVE-2026-11748 (A vulnerability has been identified in centraldogma-server-auth-shiro ...)
@@ -170615,6 +170650,7 @@ CVE-2025-53629 (cpp-httplib is a C++11 single-file header-only cross platform HT
{DSA-6228-1}
[experimental] - cpp-httplib 0.25.0+ds-1
- cpp-httplib 0.25.0+ds-3 (bug #1109340)
+ [bookworm] - cpp-httplib <postponed> (Minor issue, DoS)
NOTE: https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-qjmq-h3cc-qv6w
NOTE: https://github.com/yhirose/cpp-httplib/commit/082acacd4581d10e05fccbe9cb336aa7822c4ea2 (v0.23.0)
CVE-2025-53628 (cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTT ...)
@@ -175048,6 +175084,7 @@ CVE-2025-1991 (IBM Informix Dynamic Server 12.10,14.10, and15.0 could allow a re
NOT-FOR-US: IBM
CVE-2025-53391 (The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zu ...)
- zulucrypt <removed> (bug #1108288)
+ [bullseye] - zulucrypt <end-of-life> (EOL in bullseye LTS)
CVE-2025-6816 (A vulnerability classified as problematic was found in HDF5 1.14.6. Th ...)
- hdf5 <unfixed> (bug #1108482; unimportant)
NOTE: https://github.com/HDFGroup/hdf5/issues/5571
@@ -191921,6 +191958,7 @@ CVE-2025-46728 (cpp-httplib is a C++ header-only HTTP/HTTPS server and client li
{DSA-6228-1}
[experimental] - cpp-httplib 0.20.1+ds-3
- cpp-httplib 0.25.0+ds-3 (bug #1104926)
+ [bookworm] - cpp-httplib <postponed> (Minor issue, DoS)
NOTE: https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-px83-72rx-v57c
NOTE: Fixed by: https://github.com/yhirose/cpp-httplib/commit/7b752106ac42bd5b907793950d9125a0972c8e8e (v0.20.1)
CVE-2025-46593 (Process residence vulnerability in abnormal scenarios in the print mod ...)
=====================================
data/dla-needed.txt
=====================================
@@ -536,6 +536,9 @@ perl
NOTE: 20260527: Added by Front-Desk (santiago)
NOTE: 20260527: wait for the DSA before releasing
--
+php-horde-imp/bullseye
+ NOTE: 20260714: Added by Front-Desk (Beuc)
+--
php-laravel-framework
NOTE: 20250307: Added by Front-Desk (rouca)
NOTE: 20251027: History of upstream branch fixing v12: git log 9de75259..2d133034^2.
@@ -777,6 +780,11 @@ watcher/bullseye
wireshark/bullseye
NOTE: 20260430: Added by Front-Desk (lamby)
--
+wolfssl/bookworm
+ NOTE: 20260714: Added by Front-Desk (Beuc)
+ NOTE: 20260714: Upstream interested in helping with bookworm (Beuc/front-desk)
+ NOTE: 20260714: https://lists.debian.org/debian-lts/2026/07/msg00020.html
+--
xen/bookworm
NOTE: 20260714: Added by Front-Desk (Beuc)
NOTE: 20260714: Upcoming DSA + 2 postponed CVEs fixed in trixie (Beuc/front-desk)
@@ -808,10 +816,3 @@ zabbix/bullseye
NOTE: 20260328: Added by Front-Desk (Beuc)
NOTE: 20260328: CVE-2026-23919->24 appear to be in supported scope (Beuc/front-desk)
--
-zulucrypt/bullseye
- NOTE: 20250727: Added by Front-Desk (ta)
- NOTE: 20251203: sent a mail to the maintainer asking about plans to address #1108288 (dleidert)
- NOTE: 20260130: removed from archive without patch; Debian-specific CVE (root escalalation); consider dropping from all active dists (Beuc)
- NOTE: 20260425: bookmorm RM: https://bugs.debian.org/1134891
- NOTE: 20260503: bullseye RM: https://bugs.debian.org/1135634 (Beuc)
---
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/1f92d066acdd85e53d26695d5412d1d01e533b6b...e044ae3366be4c102c74dcdf59c8472611cd19a5
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/1f92d066acdd85e53d26695d5412d1d01e533b6b...e044ae3366be4c102c74dcdf59c8472611cd19a5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260714/8d999fbb/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list