[Git][security-tracker-team/security-tracker][master] Add CVE-2026-16118 and associate it to glib2.0

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
768c0b7f by Salvatore Bonaccorso at 2026-07-23T23:27:25+02:00
Add CVE-2026-16118 and associate it to glib2.0

glib2.0 embedds xdgmime and uses it.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -7908,7 +7908,10 @@ CVE-2026-42168 (django-pyas2 through 1.2.3 is vulnerable to OS command injection
 CVE-2026-36669 (An unauthenticated arbitrary file upload vulnerability in ck_upload_ha ...)
 	NOT-FOR-US: Feng Office
 CVE-2026-16118 (A flaw was found in xdgmime. A heap-based buffer overflow can be trigg ...)
-	TODO: check
+	- glib2.0 <unfixed>
+	NOTE: https://gitlab.gnome.org/GNOME/glib/-/work_items/3992
+	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2501732
+	NOTE: https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41
 CVE-2026-16076 (A vulnerability has been found in AstrBotDevs AstrBot up to 4.25.5. Th ...)
 	NOT-FOR-US: AstrBotDevs AstrBot
 CVE-2026-16075 (A flaw has been found in AstrBotDevs AstrBot up to 4.25.5. This vulner ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/768c0b7ff398ab3b34b012269190fa29795d494b

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/768c0b7ff398ab3b34b012269190fa29795d494b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260723/449b7c5d/attachment-0001.htm>