[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Sun Nov 1 18:53:40 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
c83904b8 by Moritz Muehlenhoff at 2026-11-01T19:52:17+01:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -47,6 +47,7 @@ CVE-2026-13575
NOT-FOR-US: HTTP::Session Perl module
CVE-2026-111426
- kdeconnect <unfixed> (bug #1152780)
+ [trixie] - kdeconnect <no-dsa> (Minor issue)
NOTE: https://kde.org/info/security/advisory-20261030-2.txt
NOTE: Fixed by: https://invent.kde.org/network/kdeconnect-kde/-/commit/71c63c47b51047533f5d9533f27be4375778b21d (release/26.08 branch)
CVE-2026-120252 (imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer ...)
@@ -139,6 +140,7 @@ CVE-2026-15272 (The Web 2.0 Directory plugin for WordPress is vulnerable to time
NOT-FOR-US: WordPress plugin
CVE-2026-120210 (FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in th ...)
- ffmpeg <unfixed>
+ [trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/25341
CVE-2026-120209 (AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secre ...)
NOT-FOR-US: AJ-Report
@@ -162,6 +164,7 @@ CVE-2026-120199 (LearnHouse before 1.1.1 contains a missing authorization vulner
NOT-FOR-US: LearnHouse
CVE-2026-120194 (A flaw was found in json-glib. The JSONPath slice evaluator used by js ...)
- json-glib <unfixed>
+ [trixie] - json-glib <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/json-glib/-/issues/96
CVE-2026-120114 (The Debug Log Manager \u2013 Conveniently Monitor and Inspect Errors p ...)
NOT-FOR-US: WordPress plugin
@@ -288,6 +291,7 @@ CVE-2026-63410 (secp256k1-native is a native C secp256k1 implementation for Ruby
NOT-FOR-US: secp256k1-native Ruby gem
CVE-2026-63402 (i18next is an internationalization framework for JavaScript. Prior to ...)
- node-i18next <unfixed> (bug #1152688)
+ [trixie] - node-i18next <no-dsa> (Minor issue)
NOTE: https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx
NOTE: Fixed by: https://github.com/i18next/i18next/commit/642137b7786d83661ec3ee53027798dc4b81d30a (v26.3.4)
CVE-2026-63401 (Coop is an open source review and moderation tool from ROOST. Prior to ...)
@@ -653,6 +657,7 @@ CVE-2026-85268 (A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/
NOT-FOR-US: Google Cloud
CVE-2026-84243 (The gettext family of functions in the GNU C Library version 2.0 and l ...)
- glibc <unfixed> (bug #1152640)
+ [trixie] - glibc <no-dsa> (Minor issue)
NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=17142
NOTE: https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0025
CVE-2026-82104 (In Teltonika Networks RUTOS devices running versions from 7.22 through ...)
@@ -1216,7 +1221,12 @@ CVE-2026-119367 (Missing Authorization vulnerability in Liquid Web / StellarWP T
CVE-2026-119365 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-119364 (ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link ...)
+<<<<<<< HEAD
- proftpd-dfsg <unfixed> (bug #1152788)
+=======
+ - proftpd-dfsg <unfixed>
+ [trixie] - proftpd-dfsg <no-dsa> (Minor issue)
+>>>>>>> 5ca8ef9b4d (trixie triage)
NOTE: https://github.com/proftpd/proftpd/issues/2374
NOTE: Fixed by: https://github.com/proftpd/proftpd/commit/c41691f8981f98081fcb8a535c3c21b06a3f04af (v1.3.10rc5)
CVE-2026-119300 (Wekan is open source kanban built with Meteor. Prior to 11.11, the use ...)
@@ -1243,10 +1253,12 @@ CVE-2026-119148 (Incomplete string validation in AWS aws-nitro-enclaves-sdk-c be
NOT-FOR-US: Amazon
CVE-2026-119147 (ProFTPD before 1.3.9e and 1.3.10rc5 contains an authorization bypass i ...)
- proftpd-dfsg 1.3.9e~dfsg-1
+ [trixie] - proftpd-dfsg <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/proftpd/proftpd/commit/b7d3de4565ae448a510feecd17b41923e44bfe16 (v1.3.10rc5)
NOTE: Fixed by: https://github.com/proftpd/proftpd/commit/1570fd3b7a70b447bd59b175ed7fb01fb3d8242b (v1.3.9e)
CVE-2026-119146 (ProFTPD before 1.3.9e and 1.3.10rc5 contains a buffer overflow vulnera ...)
- proftpd-dfsg 1.3.9e~dfsg-1
+ [trixie] - proftpd-dfsg <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/proftpd/proftpd/commit/502d280b8d0ef72e44c6dd0a35a9405af0a1e301 (v1.3.10rc5)
NOTE: Fixed by: https://github.com/proftpd/proftpd/commit/4bafd1e9861506e77b9ea3ed277b58e60eacfe4d (v1.3.9e)
CVE-2026-119117 (Insertion of sensitive information into a log file in Amazon Kinesis P ...)
@@ -8101,24 +8113,36 @@ CVE-2026-116588 (Datadog dd-trace-py is the Datadog Python APM client. From 1.5.
NOT-FOR-US: dd-trace-py
CVE-2026-116587 (Go JOSE provides an implementation of the Javascript Object Signing an ...)
- golang-github-go-jose-go-jose <unfixed>
+ [trixie] - golang-github-go-jose-go-jose <no-dsa> (Minor issue)
- golang-github-go-jose-go-jose.v3 <unfixed>
+ [trixie] - golang-github-go-jose-go-jose.v3 <no-dsa> (Minor issue)
- golang-gopkg-square-go-jose.v2 <unfixed>
+ [trixie] - golang-gopkg-square-go-jose.v2 <no-dsa> (Minor issue)
- golang-gopkg-square-go-jose.v1 <unfixed>
+ [trixie] - golang-gopkg-square-go-jose.v1 <no-dsa> (Minor issue)
NOTE: https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q
NOTE: https://github.com/go-jose/go-jose/commit/a0111f82742fa92bceec9ede40845e73319e6230 (v4.1.6)
CVE-2026-116586 (Go JOSE provides an implementation of the Javascript Object Signing an ...)
- golang-github-go-jose-go-jose <unfixed>
+ [trixie] - golang-github-go-jose-go-jose <no-dsa> (Minor issue)
- golang-github-go-jose-go-jose.v3 <unfixed>
+ [trixie] - golang-github-go-jose-go-jose.v3 <no-dsa> (Minor issue)
- golang-gopkg-square-go-jose.v2 <unfixed>
+ [trixie] - golang-gopkg-square-go-jose.v2 <no-dsa> (Minor issue)
- golang-gopkg-square-go-jose.v1 <unfixed>
+ [trixie] - golang-gopkg-square-go-jose.v1 <no-dsa> (Minor issue)
NOTE: https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4
NOTE: https://github.com/go-jose/go-jose/pull/290
NOTE: https://github.com/go-jose/go-jose/commit/a31af25836222f4c45d366d6e8f9b1049dd9935a (v4.1.5)
CVE-2026-116585 (Go JOSE provides an implementation of the Javascript Object Signing an ...)
- golang-github-go-jose-go-jose <unfixed>
+ [trixie] - golang-github-go-jose-go-jose <no-dsa> (Minor issue)
- golang-github-go-jose-go-jose.v3 <unfixed>
+ [trixie] - golang-github-go-jose-go-jose.v3 <no-dsa> (Minor issue)
- golang-gopkg-square-go-jose.v2 <unfixed>
+ [trixie] - golang-gopkg-square-go-jose.v2 <no-dsa> (Minor issue)
- golang-gopkg-square-go-jose.v1 <unfixed>
+ [trixie] - golang-gopkg-square-go-jose.v1 <no-dsa> (Minor issue)
NOTE: https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q
NOTE: https://github.com/go-jose/go-jose/pull/292
NOTE: https://github.com/go-jose/go-jose/commit/74114c2fa22669a2b2a296746eaa82e15566fd54 (v4.1.5)
@@ -19419,7 +19443,9 @@ CVE-2026-90910 (Missing authentication for critical function vulnerability in Ap
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-8168 (Uncontrolled recursion in the SVG parser and renderer of the Qt SVG mo ...)
- qt6-svg 6.11.2-2
+ [trixie] - qt6-svg <no-dsa> (Minor issue)
- qtsvg-opensource-src <unfixed>
+ [trixie] - qtsvg-opensource-src <no-dsa> (Minor issue)
NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-8168:
CVE-2026-88901 (Improper Restriction of XML External Entity Reference vulnerability in ...)
NOT-FOR-US: Apache software not packaged in Debian
@@ -20380,6 +20406,7 @@ CVE-2026-111998 (Vanus 0.8.0 through 0.9.0 contains a default credentials vulner
NOT-FOR-US: Vanus
CVE-2026-111997 (ip-address before 10.7.4 allows a denial of service (CPU consumption f ...)
- node-ip-address 10.7.4-1 (bug #1151933)
+ [trixie] - node-ip-address <no-dsa> (Minor issue)
NOTE: https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rxp7-6hxx-x8q5
CVE-2026-111993 (A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015a ...)
NOT-FOR-US: Soarkey StudentManagement
@@ -23073,34 +23100,42 @@ CVE-2026-102607 (ZoneMinder is a free, open source closed-circuit television sof
NOTE: Only supported for trusted users/behind auth
CVE-2026-110759 (Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is ...)
- libtext-csv-xs-perl 1.65-1 (bug #1151096)
+ [trixie] - libtext-csv-xs-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44408696/
NOTE: Fixed by: https://github.com/cpan-authors/Text-CSV_XS/commit/7627f1a2bb8ffe4e81d9847318a060822043f7f3 (1.65)
CVE-2026-110758 (Text::CSV_XS versions before 1.65 for Perl read before the start of an ...)
- libtext-csv-xs-perl 1.65-1 (bug #1151096)
+ [trixie] - libtext-csv-xs-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44408695/
NOTE: Fixed by: https://github.com/cpan-authors/Text-CSV_XS/commit/efed7ee21177c59a5b69e787f84154e1fcb0d095 (1.65)
CVE-2026-110757 (Text::CSV_XS versions before 1.65 for Perl allow record splitting by w ...)
- libtext-csv-xs-perl 1.65-1 (bug #1151096)
+ [trixie] - libtext-csv-xs-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44408694/
NOTE: Fixed by: https://github.com/cpan-authors/Text-CSV_XS/commit/fcfb796cb50de9cef8b94a70535304ac41a50c56 (1.65)
CVE-2026-110756 (Text::CSV_XS versions before 1.65 for Perl drop the end of a record an ...)
- libtext-csv-xs-perl 1.65-1 (bug #1151096)
+ [trixie] - libtext-csv-xs-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44408690/
NOTE: Fixed by: https://github.com/cpan-authors/Text-CSV_XS/commit/0610a8d81262ae6f1ac82a88d73c8a471f38af19 (1.65)
CVE-2026-110755 (Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by ...)
- libtext-csv-xs-perl 1.65-1 (bug #1151096)
+ [trixie] - libtext-csv-xs-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44408689/
NOTE: Fixed by: https://github.com/cpan-authors/Text-CSV_XS/commit/f25e00aacd6fc15857b22487cb2e5ca263f377e0 (1.65)
CVE-2026-110754 (Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a ...)
- libtext-csv-xs-perl 1.65-1 (bug #1151096)
+ [trixie] - libtext-csv-xs-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44408685/
NOTE: Fixed by: https://github.com/cpan-authors/Text-CSV_XS/commit/eb4f739ffc605bfb1ab710e5330704faa0e89f08 (1.65)
CVE-2026-110752 (Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by ...)
- libtext-csv-xs-perl 1.65-1 (bug #1151096)
+ [trixie] - libtext-csv-xs-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44408679/
NOTE: Fixed by: https://github.com/cpan-authors/Text-CSV_XS/commit/d9d3d66f9ff6a8a1bc255a6ef05100f9b102b92b (1.65)
CVE-2026-110753 (Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after- ...)
- libtext-csv-xs-perl 1.65-1 (bug #1151096)
+ [trixie] - libtext-csv-xs-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44408682/
NOTE: Fixed by: https://github.com/cpan-authors/Text-CSV_XS/commit/f082d5c8aab1b8d16b6181d4f3042a06947e260f (1.65)
CVE-2026-97858 (An attacker can cause the server to unbind the target device from its ...)
@@ -25573,6 +25608,7 @@ CVE-2026-94348 (Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contain
NOT-FOR-US: Dell / EMC
CVE-2026-94200 (Improper Validation of Consistency within Input vulnerability in Erlan ...)
- erlang 1:29.1.2+dfsg-1 (bug #1151684)
+ [trixie] - erlang <no-dsa> (Minor issue)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-m5mh-q53w-67jq
NOTE: https://cna.erlef.org/cves/CVE-2026-94200.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-94200
@@ -26343,6 +26379,7 @@ CVE-2026-105659 (Uncontrolled Resource Consumption vulnerability in mtrudel band
NOT-FOR-US: Bandit (mtrudel/bandit, not the same as src:bandit)
CVE-2026-105236 (Improper Certificate Validation vulnerability in the ssl application i ...)
- erlang 1:29.1.2+dfsg-1 (bug #1151684)
+ [trixie] - erlang <no-dsa> (Minor issue)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-2g23-cgjh-34gq
NOTE: https://cna.erlef.org/cves/CVE-2026-105236.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-105236
@@ -50460,18 +50497,23 @@ CVE-2026-102010 (A flaw was found in GCC. When an application calls the erase_if
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478395
CVE-2026-101913 (ip-address is a library for parsing and manipulating IPv4 and IPv6 add ...)
- node-ip-address 10.7.2-1
+ [trixie] - node-ip-address <no-dsa> (Minor issue)
NOTE: https://github.com/beaugunderson/ip-address/security/advisories/GHSA-rpw4-54j3-4h4q
NOTE: Fixed by: https://github.com/beaugunderson/ip-address/commit/d03e960c7cc3179ef25c8a44b4f94dd499625546 (v10.5.1)
CVE-2026-101912 (ip-address is a library for parsing and manipulating IPv4 and IPv6 add ...)
- node-ip-address 10.7.2-1
+ [trixie] - node-ip-address <no-dsa> (Minor issue)
NOTE: https://github.com/beaugunderson/ip-address/security/advisories/GHSA-j6r3-76f7-8jcv
NOTE: Fixed by: https://github.com/beaugunderson/ip-address/commit/1343629d57fea413644a5c9d41ff1e59619f3f28 (v10.7.1)
CVE-2026-101911 (ip-address is a library for parsing and manipulating IPv4 and IPv6 add ...)
- node-ip-address 10.7.2-1
+ [trixie] - node-ip-address <no-dsa> (Minor issue)
NOTE: https://github.com/beaugunderson/ip-address/security/advisories/GHSA-h3mg-xc3c-68pw
NOTE: Fixed by: https://github.com/beaugunderson/ip-address/commit/469ead1231b4cc059f2150c626e1e0c2895c0134 (v10.7.1)
CVE-2026-101910 (ip-address is a library for parsing and manipulating IPv4 and IPv6 add ...)
- node-ip-address 10.7.2-1
+ [trixie] - node-ip-address <not-affected> (Vulnerable code not present, introduced in 10.2.0)
+ [bookworm] - node-ip-address <not-affected> (Vulnerable code not present, introduced in 10.2.0)
NOTE: https://github.com/beaugunderson/ip-address/security/advisories/GHSA-2vr4-cq9g-pvrc
NOTE: Fixed by: https://github.com/beaugunderson/ip-address/commit/ab3dc88bcf5374344168a2ba075ca7ac4ff257f8 (v10.5.1)
CVE-2026-101909 (Axios is a promise-based HTTP client for the browser and Node.js. From ...)
@@ -60940,10 +60982,12 @@ CVE-2026-75892 (In osmo-ggsn 1.14.0 an out of bounds write issue was found in th
NOTE: Fixed in: https://cgit.osmocom.org/osmo-ggsn/commit/?id=6c322f4dd339401a437da3c89c95f2bf64bca995 (1.15.0)
CVE-2026-85495
- ppp <unfixed> (bug #1148821)
+ [trixie] - ppp <no-dsa> (Minor issue)
[bookworm] - ppp <postponed> (Minor issue)
NOTE: https://github.com/ppp-project/ppp/security/advisories/GHSA-frhv-j822-2pvx
CVE-2026-75883 (The code in pppd that formats a response to a PEAP Request packet in p ...)
- ppp <unfixed> (bug #1148816)
+ [trixie] - ppp <no-dsa> (Minor issue)
[bookworm] - ppp <not-affected> (PEAP support introduced in 2.5.0)
NOTE: https://github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35
CVE-2026-75157 (Apache Airflow's asset queued-events DELETE endpoints checked the call ...)
@@ -819595,9 +819639,7 @@ CVE-2019-7733 (In Live555 0.95, there is a buffer overflow via a large integer i
NOTE: https://github.com/rgaufman/live555/issues/21
NOTE: fixed in 2019.05.12: http://www.live555.com/liveMedia/public/changelog.txt
CVE-2019-7732 (In Live555 0.95, a setup packet can cause a memory leak leading to DoS ...)
- - liblivemedia <unfixed> (unimportant)
- [stretch] - liblivemedia <no-dsa> (Minor issue)
- [jessie] - liblivemedia <no-dsa> (Minor issue, unlikely to be exploited in practice)
+ NOTE: Bogus report
NOTE: https://github.com/rgaufman/live555/issues/20
NOTE: upstream considers this issue invalid: http://lists.live555.com/pipermail/live-devel/2019-May/021218.html
CVE-2019-7731 (MyWebSQL 3.7 has a remote code execution (RCE) vulnerability after an ...)
=====================================
data/dsa-needed.txt
=====================================
@@ -134,6 +134,8 @@ pacemaker
pdfminer (carnil)
Required followup for CVE-2025-64512 as original fix was incomplete.
--
+pdns-recursor (jmm)
+--
pillow
more CVEs to come
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c83904b8e898512f501891fed4c155f598619554
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c83904b8e898512f501891fed4c155f598619554
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261101/08924e6b/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list