[Git][security-tracker-team/security-tracker][master] Add CVE-2026-11979/libxml2

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0a8d50ff by Salvatore Bonaccorso at 2026-06-29T21:31:43+02:00
Add CVE-2026-11979/libxml2

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -259,7 +259,10 @@ CVE-2026-12672
 CVE-2026-12616 (The /v1/upload/sbom endpoint extracts the iss claim from the attacker- ...)
 	TODO: check
 CVE-2026-11979 (libxml2 is vulnerable to multiple stack-based buffer overflows in the  ...)
-	TODO: check
+	- libxml2 <unfixed> (unimportant)
+	NOTE: https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124
+	NOTE: https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e
+	NOTE: Not considered a security issue upstream
 CVE-2026-11720 (A path traversal vulnerability exists in the HTTP tool URL builder of  ...)
 	TODO: check
 CVE-2026-54371 (attr before version 2.6.0 contains a symlink traversal vulnerability i ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0a8d50ff8b734258234a0ebfcf5370ad850a01d5

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0a8d50ff8b734258234a0ebfcf5370ad850a01d5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260629/04b88acd/attachment.htm>