[Git][security-tracker-team/security-tracker][master] 9 commits: lts: add dpdk to dla-needed
Daniel Leidert (@dleidert)
dleidert at debian.org
Mon Nov 2 06:38:11 GMT 2026
Daniel Leidert pushed to branch master at Debian Security Tracker / security-tracker
Commits:
38337b7a by Daniel Leidert at 2026-11-02T07:36:08+01:00
lts: add dpdk to dla-needed
- - - - -
56ada678 by Daniel Leidert at 2026-11-02T07:36:09+01:00
lts: mark CVE-2026-119124/imagemagick as not affecting Bookworm
- - - - -
803cd3a2 by Daniel Leidert at 2026-11-02T07:36:09+01:00
Add patch link for CVE-2026-45070/symfony
BTW: The CVE description is wrong. The linked article lists the correct fixed versions.
- - - - -
375668a5 by Daniel Leidert at 2026-11-02T07:36:09+01:00
lts: add symfony to dla-needed
- - - - -
9dcea184 by Daniel Leidert at 2026-11-02T07:36:09+01:00
lts: postpone CVE-2026-92705/aegisub
- - - - -
9e3ed1a5 by Daniel Leidert at 2026-11-02T07:36:10+01:00
lts: mark CVE-2026-113495,CVE-2026-113496/cockpit-machines as postponed
Both issue are similar. They can be mitigated by not allowing cross-user
process inspection.
- - - - -
85f2ec76 by Daniel Leidert at 2026-11-02T07:36:10+01:00
lts: mark a bunch of curl issues as postponed
- - - - -
938d7d2c by Daniel Leidert at 2026-11-02T07:36:10+01:00
lts: postpone CVE-2026-116723,CVE-2026-116724/fltk1.3,fltk1.4
- - - - -
c4b87f88 by Daniel Leidert at 2026-11-02T07:36:10+01:00
lts: postpone CVE-2026-116742/bookworm
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -2644,6 +2644,7 @@ CVE-2026-119125 (Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 ret
NOT-FOR-US: Parse Server
CVE-2026-119124 (ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in i ...)
- imagemagick 8:7.1.2.34+dfsg1-1
+ [bookworm] - imagemagick <not-affected> (Vulnerable code not present)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-x48p-6655-8qgv
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/270f70f609f659a01aaa2a8ed7bd887f79722d45 (7.1.2-34)
CVE-2026-119123 (ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in ...)
@@ -8073,6 +8074,7 @@ CVE-2026-116743 (libyal libmsiecf through 20260525 contains a double free vulner
CVE-2026-116742 (HTSlib through 1.24 contains a heap out-of-bounds write and read vulne ...)
- htslib <unfixed>
[trixie] - htslib <no-dsa> (Minor issue)
+ [bookworm] - htslib <postponed> (Minor issue)
NOTE: https://github.com/samtools/htslib/pull/2057
NOTE: Fixed by: https://github.com/samtools/htslib/commit/18dddf02bb2c0053b32acec427723555a24b2873 (1.25)
CVE-2026-116741 (Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnera ...)
@@ -8127,15 +8129,19 @@ CVE-2026-116725 (gbsplay through 0.0.103 contains an out-of-bounds read vulnerab
CVE-2026-116724 (FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BM ...)
- fltk1.3 <unfixed>
[trixie] - fltk1.3 <no-dsa> (Minor issue)
+ [bookworm] - fltk1.3 <postponed> (Minor issue; can be fixed with next upload)
- fltk1.4 <unfixed>
[trixie] - fltk1.4 <no-dsa> (Minor issue)
+ [bookworm] - fltk1.4 <postponed> (Minor issue; can be fixed with next upload)
NOTE: https://github.com/fltk/fltk/issues/1632
NOTE: https://github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1
CVE-2026-116723 (FLTK through 1.4.5 contains a stack-based buffer overflow vulnerabilit ...)
- fltk1.3 <unfixed>
[trixie] - fltk1.3 <no-dsa> (Minor issue)
+ [bookworm] - fltk1.3 <postponed> (Minor issue; can be fixed with next upload)
- fltk1.4 <unfixed>
[trixie] - fltk1.4 <no-dsa> (Minor issue)
+ [bookworm] - fltk1.4 <postponed> (Minor issue; can be fixed with next upload)
NOTE: https://github.com/fltk/fltk/issues/1632
NOTE: https://github.com/fltk/fltk/commit/3a049d8262dc759cf9737339420e8457e24c0cb1
CVE-2026-116671 (Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of ...)
@@ -18414,12 +18420,14 @@ CVE-2026-113505 (A flaw has been found in aaPanel up to 8.25.0. Impacted is the
CVE-2026-113496 (A flaw was found in cockpit-machines. When saving Virtual Network Comp ...)
- cockpit-machines <unfixed> (bug #1152783)
[trixie] - cockpit-machines <no-dsa> (Minor issue)
+ [bookworm] - cockpit-machines <postponed> (Minor issue, can be mitigated and then fixed with next release)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2556058
NOTE: https://github.com/advisories/GHSA-vxhg-j5jv-qgqm
NOTE: Fixed by: https://github.com/cockpit-project/cockpit-machines/commit/e0d400eb32ef806bfcdda701608f8dc222cec2ab
CVE-2026-113495 (A flaw was found in cockpit-machines. Red Hat Subscription Management ...)
- cockpit-machines <unfixed> (bug #1152782)
[trixie] - cockpit-machines <no-dsa> (Minor issue)
+ [bookworm] - cockpit-machines <postponed> (Minor issue, can be mitigated and then fixed with next release)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2556057
NOTE: https://github.com/advisories/GHSA-rq8f-q9xv-wmhm
NOTE: Fixed by: https://github.com/cockpit-project/cockpit-machines/commit/b058e6872778d1ae362634b44463adf387ba49ea
@@ -30711,6 +30719,7 @@ CVE-2026-92387 (By permanently omitting the final control-response line, a malic
CVE-2026-92388 (When an FTP wildcard `LIST` operation fails, libcurl omits the restora ...)
- curl 8.23.0~rc1-1
[trixie] - curl <no-dsa> (Minor issue)
+ [bookworm] - curl <postponed> (Minor issue; can be fixed with next release)
NOTE: https://curl.se/docs/CVE-2026-92388.html
NOTE: Introduced with: https://github.com/curl/curl/commit/0825cd80a62c21725fb (curl-7_21_0)
NOTE: Fixed by: https://github.com/curl/curl/commit/ba8f8a7f27a5c5e19e4ef212b90b35a93559163e (rc-8_23_0-1)
@@ -30718,12 +30727,14 @@ CVE-2026-92388 (When an FTP wildcard `LIST` operation fails, libcurl omits the r
CVE-2026-92389 (libcurl's TFTP state machine fails to validate state transitions again ...)
- curl 8.23.0~rc1-1
[trixie] - curl <no-dsa> (Minor issue)
+ [bookworm] - curl <postponed> (Minor issue; can be fixed with next release)
NOTE: https://curl.se/docs/CVE-2026-92389.html
NOTE: Introduced with: https://github.com/curl/curl/commit/56d9624b566ac15ffb4b4b6eef220a5000b767e0 (curl-7_15_0)
NOTE: https://github.com/curl/curl/commit/63dd390fab905a239a97e2700532929343ebc4e9 (rc-8_23_0-1)
CVE-2026-92390 (When invoked with `--remote-header-name` (`-J`), curl fails to preserv ...)
- curl 8.23.0~rc1-1
[trixie] - curl <no-dsa> (Minor issue)
+ [bookworm] - curl <postponed> (Minor issue; can be fixed with next release)
NOTE: https://curl.se/docs/CVE-2026-92390.html
NOTE: Introduced with: https://github.com/curl/curl/commit/80675818e0417be8c991513b328c5507e93b47e5 (curl-7_20_0)
NOTE: Fixed by: https://github.com/curl/curl/commit/c24a69d8cd368de4e25e3540bf0b7b000a31d5a7 (rc-8_23_0-1)
@@ -30797,6 +30808,7 @@ CVE-2026-87863 (An authenticated HTTPS origin can supply an HSTS `max-age` value
CVE-2026-87865 (When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelat ...)
- curl 8.23.0~rc1-1
[trixie] - curl <no-dsa> (Minor issue)
+ [bookworm] - curl <postponed> (Minor issue; can be fixed with next release)
NOTE: https://curl.se/docs/CVE-2026-87865.html
NOTE: Introduced with: https://github.com/curl/curl/commit/e96fe70cabcb3a5a009821dbb453dc0160ddc3f5 (curl-7_69_1)
NOTE: Fixed by: https://github.com/curl/curl/commit/323c184b6bdf5b1988a10c0a61560666e1588149 (rc-8_23_0-1)
@@ -30822,6 +30834,7 @@ CVE-2026-86411 (An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse
CVE-2026-87864 (Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte co ...)
- curl 8.22.0-1
[trixie] - curl <no-dsa> (Minor issue)
+ [bookworm] - curl <postponed> (Minor issue; can be fixed with next release)
NOTE: https://curl.se/docs/CVE-2026-87864.html
NOTE: Introduced with: https://github.com/curl/curl/commit/f8c8c76d39ac2fa825481ba42ab2247cd122f963 (curl-7_30_0)
NOTE: Fixed by: https://github.com/curl/curl/commit/3b547de301342b347fb3c6ea6ae7979070793a66 (curl-8_22_0)
@@ -35649,6 +35662,7 @@ CVE-2026-92705 (Aegisub is a cross-platform advanced subtitle editor. From 3.2.0
[experimental] - aegisub 3.5.1-1~exp1
- aegisub 3.5.1-1 (bug #1150511)
[trixie] - aegisub <no-dsa> (Minor issue; will be fixed via point release)
+ [bookworm] - aegisub <postponed> (Minor issue; can be fixed with next release)
NOTE: https://github.com/TypesettingTools/Aegisub/security/advisories/GHSA-67hq-5vgg-6f23
NOTE: Fixed by: https://github.com/TypesettingTools/Aegisub/commit/0a3073d59f10432eeebea65018b02ef4d0a87fff (v3.5.0-beta)
NOTE: Fixed by: https://github.com/TypesettingTools/Aegisub/commit/b5bf23979e7453f7b1cc8ffeb82b3cc2d2ca75e6 (v3.5.0-beta)
@@ -185960,6 +185974,7 @@ CVE-2026-46626
CVE-2026-45070 (Symfony is a PHP framework for web and console applications and a set ...)
- symfony 7.4.22+dfsg-1
NOTE: https://symfony.com/blog/cve-2026-45070-email-header-injection-via-non-token-characters-in-mime-parameter-names
+ NOTE: Fixed by: https://github.com/symfony/symfony/commit/8cc149f5d7dddcb02b17f8d0d3fe9b24 (v8.1.10,v7.4.22,v6.4.49,v5.4.55)
CVE-2026-45065 (Symfony is a PHP framework for web and console applications and a set ...)
{DSA-6317-1 DSA-6312-1}
- symfony 7.4.12+dfsg-1
=====================================
data/dla-needed.txt
=====================================
@@ -161,6 +161,10 @@ dokuwiki
NOTE: 20261027: None of the packaged plugins seems affected; but self-installed ones could be (dleidert/front-desk)
NOTE: 20261027: A note in the DLA should be added (dleidert/front-desk)
--
+dpdk
+ NOTE: 20261102: Added by Front-Desk (dleidert)
+ NOTE: 20261102: Follow DSA-6597-1 (dleidert/front-desk)
+--
dracut
NOTE: 20260611: Added by Front-Desk (rouca)
NOTE: 20260611: Please investigate impact of legacy network on older release of dracut aka CVE-2026-6893 (rouca/FD)
@@ -756,6 +760,9 @@ strongswan (Simon Quigley)
NOTE: 20260907: Added by Front-Desk (eamanu)
NOTE: 20261029: https://lists.debian.org/debian-lts/2026/10/msg00112.html (tsimonq2)
--
+symfony
+ NOTE: 20261102: Added by Front-Desk (dleidert)
+--
telegram-desktop
NOTE: 20261029: Added by Front-Desk (dleidert)
NOTE: 20261029: CVE-2026-107181 seems serious and should be addressed (dleidert/front-desk)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/a421a7e363c16b06d02ecd843ff0eeb8efeb78cc...c4b87f887d812c53a0cd1611e940285d68e8c69f
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/a421a7e363c16b06d02ecd843ff0eeb8efeb78cc...c4b87f887d812c53a0cd1611e940285d68e8c69f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261102/2b3cabb7/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list