[Git][security-tracker-team/security-tracker][master] Add CVE-2025-71408/nltk

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
3f7dddc8 by Salvatore Bonaccorso at 2026-07-26T21:29:26+02:00
Add CVE-2025-71408/nltk

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1457,7 +1457,10 @@ CVE-2026-16280 (An integer overflow when calculating physical offsets for sparse
 CVE-2026-14955 (The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress i ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2025-71408 (NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval  ...)
-	TODO: check
+	- nltk 3.9.3-1
+	NOTE: https://aydinnyunus.github.io/2026/06/07/command-injection-nltk-collocations-eval/
+	NOTE: https://github.com/nltk/nltk/pull/3465
+	NOTE: Fixed by: https://github.com/nltk/nltk/commit/e373c8c3d10e236672ef65c38ca7d24612941553 (3.9.3)
 CVE-2026-66374 (Knot Resolver before 6.4.1 allows remote code execution via a heap-bas ...)
 	- knot-resolver 6.4.1-1
 	NOTE: https://openwall.com/lists/oss-security/2026/07/23/6



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3f7dddc8d8ca90d611d2be73ce4d2567fb8a9e2e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3f7dddc8d8ca90d611d2be73ce4d2567fb8a9e2e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260726/f1eeab5e/attachment-0001.htm>