[Git][security-tracker-team/security-tracker][master] Add batch of Debian bug references reported
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Jul 24 08:25:50 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
49f71eb6 by Salvatore Bonaccorso at 2026-07-24T09:25:18+02:00
Add batch of Debian bug references reported
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -237,7 +237,7 @@ CVE-2026-65920 (Diffusers through 0.39.0, fixed in commit cee298c, contains a pa
CVE-2026-65919 (Meshery before 1.0.57 contains an unauthenticated arbitrary file read ...)
NOT-FOR-US: Meshery
CVE-2026-65918 (PyTorch torchvision through 0.28.0, fixed in commit 4e05dc2, contains ...)
- - pytorch-vision <unfixed>
+ - pytorch-vision <unfixed> (bug #1142689)
NOTE: https://github.com/pytorch/vision/issues/9551
NOTE: https://github.com/pytorch/vision/pull/9520
NOTE: Fixed by: https://github.com/pytorch/vision/commit/4e05dc22f5f050a9528cc0ea09ceca6cdaf8f4ed
@@ -274,7 +274,7 @@ CVE-2026-65902 (DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direc
NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-76mc-f452-cxcm
NOTE: Fixed by: https://github.com/cure53/DOMPurify/commit/7996f1dc78eb8b7922388aed75d94a9f8fad9a36
CVE-2026-65901 (DOMPurify through 3.4.6 contains a cross-site scripting vulnerability ...)
- - node-dompurify <unfixed>
+ - node-dompurify <unfixed> (bug #1142688)
NOTE: https://github.com/cure53/DOMPurify/security/advisories/GHSA-x4vx-rjvf-j5p4
CVE-2026-65900 (DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE ...)
- node-dompurify 3.4.12+dfsg-1
@@ -562,7 +562,7 @@ CVE-2026-64800 (In JetBrains GoLand before 2026.2 sensitive configuration values
CVE-2026-64799 (Joomla Extension - regularlabs.com - SSRF via remote image downloads i ...)
NOT-FOR-US: Joomla
CVE-2026-64611 (A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() ...)
- - libcupsfilters <unfixed>
+ - libcupsfilters <unfixed> (bug #1142686)
NOTE: https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-rcq7-rv5g-j3r4
NOTE: Fixed by: https://github.com/OpenPrinting/libcupsfilters/commit/4b343522823403df01f6753082df83f07d18c217
TODO: check use in embedded cups, cups-filters
@@ -1119,7 +1119,7 @@ CVE-2026-57600 (Insufficient validation of input parameters in the firmware of s
CVE-2026-57599 (There is a privilege escalation vulnerability in some Hikvision camera ...)
NOT-FOR-US: Hikvision
CVE-2026-53910 (diff3tool from GNU diffutilsis vulnerable to a heap\u2011based buffer ...)
- - diffutils <unfixed>
+ - diffutils <unfixed> (bug #1142675)
NOTE: Fixed by: https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50
NOTE: Fixed by: https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815
CVE-2026-4773 (Improper validation of specified type of input vulnerability in Magars ...)
@@ -3464,36 +3464,36 @@ CVE-2026-59144 (Data::RingBuffer::Shared versions before 0.04 for Perl allow a s
CVE-2026-59143 (Data::RoaringBitmap::Shared versions before 0.02 for Perl allow an out ...)
NOT-FOR-US: Data::RoaringBitmap::Shared Perl module
CVE-2026-56852 (A norm.Iter can enter an infinite loop when handling input containing ...)
- - golang-golang-x-text <unfixed>
+ - golang-golang-x-text <unfixed> (bug #1142674)
NOTE: https://github.com/golang/go/issues/80142
NOTE: Fixed by: https://github.com/golang/text/commit/5ae8e578e495731553eddba11b2d0e86c91a00ce (v0.39.0)
CVE-2026-56844 (A vulnerability in the Veeam Updater component of the Veeam Software A ...)
NOT-FOR-US: Veeam
CVE-2026-56820 (Netty is a network application framework for development of protocol s ...)
- - netty <unfixed>
+ - netty <unfixed> (bug #1142680)
NOTE: https://github.com/netty/netty/security/advisories/GHSA-272m-gcwp-mpwg
NOTE: Fixed by: https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b (netty-4.2.16.Final)
NOTE: Fixed by: https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 (netty-4.1.136.Final)
CVE-2026-56819 (Netty is a network application framework for development of protocol s ...)
- - netty <unfixed>
+ - netty <unfixed> (bug #1142680)
NOTE: https://github.com/netty/netty/security/advisories/GHSA-93wv-jw9v-4972
NOTE: Fixed by: https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b (netty-4.2.16.Final)
NOTE: Fixed by: https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 (netty-4.1.136.Final)
CVE-2026-56817 (Netty is a network application framework for development of protocol s ...)
- - netty <unfixed>
+ - netty <unfixed> (bug #1142680)
NOTE: https://github.com/netty/netty/security/advisories/GHSA-4qhr-g3c6-fcfx
NOTE: Fixed by: https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b (netty-4.2.16.Final)
NOTE: Fixed by: https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 (netty-4.1.136.Final)
CVE-2026-56816 (Netty is a network application framework for development of protocol s ...)
- - netty <unfixed>
+ - netty <unfixed> (bug #1142680)
NOTE: https://github.com/netty/netty/security/advisories/GHSA-hpcc-26xq-25fv
NOTE: Fixed by: https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b (netty-4.2.16.Final)
TODO: check, potentially only in 4.2.y series
CVE-2026-56746 (Netty is a network application framework for development of protocol s ...)
- - netty <unfixed>
+ - netty <unfixed> (bug #1142680)
NOTE: https://github.com/netty/netty/security/advisories/GHSA-6cqp-g7gg-8hr5
CVE-2026-56745 (Netty is a network application framework for development of protocol s ...)
- - netty <unfixed>
+ - netty <unfixed> (bug #1142680)
NOTE: https://github.com/netty/netty/security/advisories/GHSA-jppx-w49h-x2qq
NOTE: Fixed by: https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b (netty-4.2.16.Final)
NOTE: Fixed by: https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 (netty-4.1.136.Final)
@@ -3506,7 +3506,7 @@ CVE-2026-56145 (Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can
CVE-2026-56144 (Incorrect Authorization (CWE-863) in Elasticsearch can allow an authen ...)
NOT-FOR-US: Elasticsearch
CVE-2026-55851 (Netty is a network application framework for development of protocol s ...)
- - netty <unfixed>
+ - netty <unfixed> (bug #1142680)
NOTE: https://github.com/netty/netty/security/advisories/GHSA-q6cq-mhr2-jmr5
NOTE: Fixed by: https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b (netty-4.2.16.Final)
NOTE: Fixed by: https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 (netty-4.1.136.Final)
@@ -3555,14 +3555,14 @@ CVE-2026-47685 (FOG is a free open-source cloning/imaging/rescue suite/inventory
CVE-2026-47671 (Nhost is an open source Firebase alternative with GraphQL. In versions ...)
NOT-FOR-US: Nhost
CVE-2026-47667 (CImg Library is a C++ library for image processing. Prior to version 4 ...)
- - cimg <unfixed>
+ - cimg <unfixed> (bug #1142677)
NOTE: https://github.com/GreycLab/CImg/security/advisories/GHSA-rmfc-grgj-qwhv
NOTE: https://github.com/GreycLab/CImg/issues/480
NOTE: Fixed by: https://github.com/GreycLab/CImg/commit/6a69bf725ffd111a4c7dc61cc15e3661abd158ee (v4.0.0)
CVE-2026-47237 (Kubeflow Community Distribution helps users to install Kubeflow Platfo ...)
NOT-FOR-US: Kubeflow
CVE-2026-47143 (Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 an ...)
- - capstone <unfixed>
+ - capstone <unfixed> (bug #1142678)
NOTE: https://github.com/capstone-engine/capstone/security/advisories/GHSA-289w-cm54-fgrm
NOTE: https://github.com/capstone-engine/capstone/pull/2924
NOTE: Fixed by: https://github.com/capstone-engine/capstone/commit/fab595205fee206f5c21be6ed8ad2eaf9225f1c7 (5.0.8)
@@ -3989,8 +3989,8 @@ CVE-2026-16424 (Use after free in GPU in Google Chrome on Android prior to 150.0
- chromium 150.0.7871.181-1
[bullseye] - chromium <end-of-life> (see #1061268)
CVE-2026-9499 (An out-of-bounds read (buffer over-read) vulnerability exists in QText ...)
- - qt6-5compat <unfixed>
- - qtbase-opensource-src <unfixed>
+ - qt6-5compat <unfixed> (bug #1142690)
+ - qtbase-opensource-src <unfixed> (bug #1142691)
NOTE: https://codereview.qt-project.org/c/qt/qt5compat/+/723911
NOTE: https://codereview.qt-project.org/c/qt/qt5compat/+/724348 (6.11 branch)
NOTE: https://codereview.qt-project.org/c/qt/qt5compat/+/724995 (6.10 branch)
@@ -4681,12 +4681,12 @@ CVE-2026-57495 (AgenticMail gives AI agents real email addresses and phone numbe
CVE-2026-57494 (AgenticMail gives AI agents real email addresses and phone numbers. In ...)
NOT-FOR-US: AgenticMail
CVE-2026-55833 (Netty is a network application framework for development of protocol s ...)
- - netty <unfixed>
+ - netty <unfixed> (bug #1142680)
NOTE: https://github.com/netty/netty/security/advisories/GHSA-mvh2-crg5-v77c
NOTE: https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b (netty-4.2.16.Final)
NOTE: https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 (netty-4.1.136.Final)
CVE-2026-55831 (Netty is a network application framework for development of protocol s ...)
- - netty <unfixed>
+ - netty <unfixed> (bug #1142680)
NOTE: https://github.com/netty/netty/security/advisories/GHSA-6jqx-86gh-f27w
NOTE: https://github.com/netty/netty/commit/5b68c61f37aa4a3045cba624cbea239655c9003b (netty-4.2.16.Final)
NOTE: https://github.com/netty/netty/commit/bb2ff68a1fb71cb4b0eb9a9e17b66c52aff680c6 (netty-4.1.136.Final)
@@ -4817,11 +4817,11 @@ CVE-2023-37508 (HCL DevOps Plan is potentially susceptible to Cross-Site Scripti
CVE-2023-37507 (HCL DevOps Plan is susceptible to an information disclosure that can a ...)
NOT-FOR-US: HCL
CVE-2026-58624 (Improper input validation in sshd-git in Apache MINA SSHD. Apache MINA ...)
- - mina2 <unfixed>
+ - mina2 <unfixed> (bug #1142679)
- mina <removed>
NOTE: https://www.openwall.com/lists/oss-security/2026/07/20/18
CVE-2026-56624 (Improper certificate validation in Apache MINA SSHD (server-side).Apac ...)
- - mina2 <unfixed>
+ - mina2 <unfixed> (bug #1142679)
- mina <removed>
NOTE: https://www.openwall.com/lists/oss-security/2026/07/20/17
CVE-2026-56623 (Path traversal on Windows in Apache MINA SSHD component sshd-git.Apach ...)
@@ -4829,7 +4829,7 @@ CVE-2026-56623 (Path traversal on Windows in Apache MINA SSHD component sshd-git
- mina <not-affected> (Only affects MINA SSHD on Windows)
NOTE: https://www.openwall.com/lists/oss-security/2026/07/20/16
CVE-2026-56452 (Path traversal in the sshd-scp component of Apache MINA SSHD.Apache MI ...)
- - mina2 <unfixed>
+ - mina2 <unfixed> (bug #1142679)
- mina <removed>
NOTE: https://www.openwall.com/lists/oss-security/2026/07/20/15
CVE-2026-61548 [rsyslog mmpstrucdata stack overflow]
@@ -4868,7 +4868,7 @@ CVE-2026-64620 (FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based
- freerdp2 <removed>
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pjqx-v446-x7fc
CVE-2026-64612 (A flaw was found in libcupsfilters and cups-filters. The PNG image rea ...)
- - libcupsfilters <unfixed>
+ - libcupsfilters <unfixed> (bug #1142687)
- cups-filters <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2502801
NOTE: https://github.com/OpenPrinting/libcupsfilters/security/advisories/GHSA-7mxj-cfq5-84ch (not public)
@@ -8121,7 +8121,7 @@ CVE-2026-44979 (@hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @ha
CVE-2026-44974 (@hapi/content provided HTTP Content-* headers parsing. Prior to 6.0.2, ...)
NOT-FOR-US: hapi/content
CVE-2026-44891 (Netty is a network application framework for development of protocol s ...)
- - netty <unfixed>
+ - netty <unfixed> (bug #1142680)
NOTE: https://github.com/netty/netty/security/advisories/GHSA-vhch-2wf3-m8rp
NOTE: https://github.com/netty/netty/pull/17063
NOTE: https://github.com/netty/netty/pull/17065
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/49f71eb684666c482327f62fb1580689ed9d2204
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/49f71eb684666c482327f62fb1580689ed9d2204
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260724/f15f52ab/attachment.htm>
More information about the debian-security-tracker-commits
mailing list