[Git][security-tracker-team/security-tracker][master] Reserve DLA-4621-1 for glibc

[Arnaud Rebillout (@arnaudr)]

Arnaud Rebillout pushed to branch master at Debian Security Tracker / security-tracker


Commits:
72a1eebd by Arnaud Rebillout at 2026-06-08T09:10:54+07:00
Reserve DLA-4621-1 for glibc

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -75316,7 +75316,6 @@ CVE-2025-15281 (Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND
 	- glibc 2.42-11 (bug #1126266)
 	[trixie] - glibc 2.41-12+deb13u2
 	[bookworm] - glibc 2.36-9+deb12u14
-	[bullseye] - glibc <postponed> (Minor issue, unlikely scenario)
 	NOTE: https://www.openwall.com/lists/oss-security/2026/01/20/3
 	NOTE: Introduced with: https://sourceware.org/git/?p=glibc.git;a=commit;h=8f2ece695d8822e9ecc63ecd157e90bf17a6fe65 (glibc-2.0.92)
 	NOTE: Fixed by: https://sourceware.org/git/?p=glibc.git;a=commit;h=80cc58ea2de214f85b0a1d902a3b668ad2ecb302 (glibc-2.43)
@@ -76201,7 +76200,6 @@ CVE-2026-0915 (Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch
 	- glibc 2.42-8 (bug #1125748)
 	[trixie] - glibc 2.41-12+deb13u2
 	[bookworm] - glibc 2.36-9+deb12u14
-	[bullseye] - glibc <postponed> (Minor issue, high attack complexity)
 	NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=33802
 	NOTE: https://www.openwall.com/lists/oss-security/2026/01/16/6
 	NOTE: Introduced with: https://sourceware.org/git/?p=glibc.git;a=commit;h=5f0e6fc702296840d2daa39f83f6cb1e40073d58 (glibc-1.93)
@@ -76820,7 +76818,6 @@ CVE-2026-0861 (Passing too large an alignment to the memalign suite of functions
 	- glibc 2.42-8 (bug #1125678)
 	[trixie] - glibc 2.41-12+deb13u2
 	[bookworm] - glibc 2.36-9+deb12u14
-	[bullseye] - glibc <postponed> (Minor issue, unlikely scenario)
 	NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=33796
 	NOTE: https://www.openwall.com/lists/oss-security/2026/01/16/5
 	NOTE: Introduced with: https://sourceware.org/git/?p=glibc.git;a=commit;h=9bf8e29ca136094f73f69f725f15c51facc97206 (glibc-2.30)
@@ -140867,7 +140864,6 @@ CVE-2025-8060 (A vulnerability has been found in Tenda AC23 16.03.07.52 and clas
 CVE-2025-8058 (The regcomp function in the GNU C library version from 2.4 to 2.41 is  ...)
 	- glibc 2.41-11 (bug #1109803)
 	[bookworm] - glibc 2.36-9+deb12u13
-	[bullseye] - glibc <postponed> (Minor issue)
 	NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=33185
 	NOTE: https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2025-0005
 	NOTE: Introduced with: https://sourceware.org/git/?p=glibc.git;a=commit;h=963d8d782fc98fb6dc3a66f0068795f9920c269d (glibc-2.4)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[08 Jun 2026] DLA-4621-1 glibc - security update
+	{CVE-2025-8058 CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 CVE-2026-4046}
+	[bullseye] - glibc 2.31-13+deb11u14
 [07 Jun 2026] DLA-4620-1 apache2 - security update
 	{CVE-2026-49975}
 	[bullseye] - apache2 2.4.67-1~deb11u2


=====================================
data/dla-needed.txt
=====================================
@@ -177,10 +177,6 @@ glances/bullseye
   NOTE: 20260518: Added by Front-Desk (Beuc)
   NOTE: 20260518: Many postponed vulnerabilities piled-up (Beuc/front-desk)
 --
-glibc/bullseye (arnaudr)
-  NOTE: 20260404: Added by Front-Desk (ta)
-  NOTE: 20260404: no upstream fix yet
---
 golang-github-gorilla-csrf/bullseye
   NOTE: 20250422: Added by Front-Desk (rouca)
   NOTE: 20250422: Need to binNMU reverse depends (in that order): golang-github-alecthomas-chroma, golang-github-niklasfasching-go-org, golang-github-yuin-goldmark-highlighting, hugo (rouca)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72a1eebdb6481923a184eb97d79f781d6d649494

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72a1eebdb6481923a184eb97d79f781d6d649494
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260608/feff7634/attachment-0001.htm>