[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Mon Nov 2 08:20:08 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
014810e9 by Moritz Muehlenhoff at 2026-11-02T09:17:26+01:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/DSA/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -439,26 +439,31 @@ CVE-2026-120248 (Thelia before 3.1.1 contains a stored cross-site scripting vuln
NOT-FOR-US: Thelia
CVE-2026-120247 (FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vuln ...)
- ffmpeg <unfixed>
+ [trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24869
NOTE: Introduced with: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/f6577bd9cf3e49d522242771184834d6b0c157fd (n2.3)
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/7c73707355708c846f718cca90096bc1a33c8989
CVE-2026-120246 (FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vuln ...)
- ffmpeg <unfixed>
+ [trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24856
NOTE: Introduced with: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/e8189515050ae2e4e204f1f0aa9d0cdca3169903 (n4.4)
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/47313ad3f9f33b892384b976fb7c09b3c85fd74e
CVE-2026-120245 (FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vul ...)
- ffmpeg <unfixed>
+ [trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24877
NOTE: Introduced with: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ceb0dd9f1e76a2a2c903fa942e47e8164e0dbedf (n0.10)
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/356a391bf57df2fb80fd61f2821c8c83d15ce180
CVE-2026-120244 (FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vuln ...)
- ffmpeg <unfixed>
+ [trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24868
NOTE: Introduced with: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/50617fce073ca3e360388b38a83341e37db92b80 (n2.1)
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ecd5dfc308a164757e7f25b1afefd8db21b43cf9
CVE-2026-120243 (FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vuln ...)
- ffmpeg <unfixed>
+ [trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24858
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/edad2d0dafcf44fa315eab716fd0183ce808053b
CVE-2026-120218 (A flaw has been found in Typemill up to 2.26.0. The impacted element i ...)
@@ -3774,21 +3779,25 @@ CVE-2026-118659 (Happy DOM is a JavaScript implementation of a web browser witho
NOT-FOR-US: Happy DOM
CVE-2026-118658 (Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
+ [trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-23wf-92cp-8pcj
NOTE: Fixed by: https://github.com/labstack/echo/commit/ca4f38a474302aabee93c66bdd0052359882e181 (v4.15.2)
NOTE: Fixed by: https://github.com/labstack/echo/commit/d1d8ad3f99dd9b80542cd0c357d56a8916c515df (v5.1.1)
CVE-2026-118657 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
+ [trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-2ffq-g2xg-c22p
NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
CVE-2026-118656 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI che ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
+ [trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-v753-g4cw-jm48
NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
CVE-2026-118655 (Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Stat ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
+ [trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-xwq5-6cqp-vx96
NOTE: https://github.com/labstack/echo/issues/2599
NOTE: https://github.com/labstack/echo/pull/3006
@@ -3796,20 +3805,24 @@ CVE-2026-118655 (Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middlewa
NOTE: Fixed by: https://github.com/labstack/echo/commit/a9ede66a5a7196411131beb1ee801e75bbaf7ac6 (v5.2.0)
CVE-2026-118654 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static f ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
+ [trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-3pmx-cf9f-34xr
NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
CVE-2026-118653 (Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP fal ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
+ [trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-246p-cpwv-v3jq
NOTE: Fixed by: https://github.com/labstack/echo/commit/22e4b71109ef072ef011a489066ec662ca9565b2 (v5.1.0)
CVE-2026-118652 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP a ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
+ [trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-h9g5-28mm-hx3g
NOTE: Fixed by: https://github.com/labstack/echo/commit/b838391e2eade87ae7e5a09d7bb5087bec271ec1 (v4.16.0)
NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
CVE-2026-118651 (Echo is a Go web framework. From 4.0.0 until 5.4.0, the Proxy middlewa ...)
- golang-github-labstack-echo <unfixed> (bug #1152486)
+ [trixie] - golang-github-labstack-echo <no-dsa> (Minor issue)
NOTE: https://github.com/labstack/echo/security/advisories/GHSA-99jh-6h7p-pp36
NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
CVE-2026-118650 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a globally moun ...)
@@ -5573,6 +5586,7 @@ CVE-2026-15323 (The Product Designer for WooCommerce WordPress | Lumise plugin f
NOT-FOR-US: WordPress plugin
CVE-2026-118384 (GNU mtools before 4.0.50 has an out-of-bounds write in parse_vses in v ...)
- mtools <unfixed>
+ [trixie] - mtools <no-dsa> (Minor issue)
NOTE: https://lists.gnu.org/archive/html/info-mtools/2026-10/msg00002.html
CVE-2026-118378 (Tabularis before 0.28.0 contains an SQL injection vulnerability in its ...)
NOT-FOR-US: Tabularis
@@ -5840,6 +5854,7 @@ CVE-2026-116690 (MLflow is an open source AI engineering platform for agents, la
NOT-FOR-US: mlflow
CVE-2026-116689 (follow-redirects is a Node.js HTTP and HTTPS client wrapper that autom ...)
- node-follow-redirects <unfixed>
+ [trixie] - node-follow-redirects <no-dsa> (Minor issue)
NOTE: https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-mrwp-f3q8-3g9p
NOTE: Fixed by: https://github.com/follow-redirects/follow-redirects/commit/b0a7751e9cd64cd8eeb6ec67d2f206a9cc88d3f8 (v1.16.2)
CVE-2026-116688 (CKEditor 5 is a modern JavaScript rich-text editor with an MVC archite ...)
@@ -8462,10 +8477,12 @@ CVE-2026-116740 (libcss through 0.9.2 contains a NULL pointer dereference vulner
NOTE: netsurf bundles a copy, but not security impact
CVE-2026-116739 (VMime through 0.9.2 contains an information disclosure vulnerability i ...)
- libvmime <unfixed>
+ [trixie] - libvmime <no-dsa> (Minor issue)
NOTE: https://github.com/kisli/vmime/pull/363
NOTE: Fixed by: https://github.com/kisli/vmime/commit/e85925eddc638939f0eeb7ee55ec047d04a760d8
CVE-2026-116738 (VMime through 0.9.2 contains an integer underflow in the uuEncoder::de ...)
- libvmime <unfixed>
+ [trixie] - libvmime <no-dsa> (Minor issue)
NOTE: https://github.com/kisli/vmime/pull/363
NOTE: Fixed by: https://github.com/kisli/vmime/commit/e85925eddc638939f0eeb7ee55ec047d04a760d8
CVE-2026-116737 (libphdi through 20260902 contains a heap out-of-bounds read vulnerabil ...)
@@ -8545,6 +8562,7 @@ CVE-2026-116602 (A vulnerability was detected in SourceCodester Online Food Orde
NOT-FOR-US: SourceCodester
CVE-2026-116591 (compress provides various compression algorithms. Prior to 1.20.2, the ...)
- golang-github-klauspost-compress 1.20.3+ds1-1
+ [trixie] - golang-github-klauspost-compress <no-dsa> (Minor issue)
NOTE: https://github.com/klauspost/compress/security/advisories/GHSA-fpmh-frq8-7rj8
NOTE: https://github.com/klauspost/compress/commit/7f5d8528720c895a6106f201719f87eb030a565d (v1.20.2)
CVE-2026-116590 (snappy-java is a Java port of the snappy, a fast C++ compresser/decomp ...)
@@ -11004,6 +11022,7 @@ CVE-2026-113951 (If an attacker can write to the filesystem of a container k8s c
NOT-FOR-US: Apple
CVE-2026-113877 (HTTP::Headers::ActionPack versions before 0.10 for Perl allow CPU exha ...)
- libhttp-headers-actionpack-perl 0.10-1 (bug #1151877)
+ [trixie] - libhttp-headers-actionpack-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44584817/
NOTE: Fixed by: https://github.com/robrwo/perl-HTTP-Headers-ActionPack/commit/77f0deb23f3de872c2e64befd72750e0f0f4bec9 (v0.10)
CVE-2026-113674 (The GeoDirectory WordPress plugin before 2.8.194 does not correctly v ...)
@@ -32283,6 +32302,7 @@ CVE-2026-102832 (JupyterLab is an extensible environment for interactive and rep
NOTE: https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-jwrc-gm9j-263p
CVE-2026-102734 (asteval is a Python expression evaluator designed for restricted execu ...)
- python-asteval <unfixed> (bug #1150909)
+ [trixie] - python-asteval <no-dsa> (Minor issue)
NOTE: https://github.com/lmfit/asteval/security/advisories/GHSA-9w56-46f6-3qhx
NOTE: https://github.com/lmfit/asteval/pull/153
NOTE: Fixed by (merge): https://github.com/lmfit/asteval/commit/a3e56e7f8ed567a4817684d94213b290359077b4 (1.0.9)
=====================================
data/DSA/list
=====================================
@@ -1,5 +1,5 @@
[01 Nov 2026] DSA-6601-1 eog - security update
- {CVE-2026-107651}
+ {CVE-2026-107651 CVE-2026-118475}
[trixie] - eog 47.0-1+deb13u1
[01 Nov 2026] DSA-6600-1 vim - security update
{CVE-2025-53905 CVE-2025-53906 CVE-2026-25749 CVE-2026-26269 CVE-2026-28417 CVE-2026-28418 CVE-2026-28419 CVE-2026-28420 CVE-2026-28421 CVE-2026-28422 CVE-2026-32249 CVE-2026-33412 CVE-2026-34982 CVE-2026-35177 CVE-2026-39881 CVE-2026-41411 CVE-2026-42307 CVE-2026-43961 CVE-2026-44656 CVE-2026-45130 CVE-2026-46483 CVE-2026-47162 CVE-2026-47167 CVE-2026-52858 CVE-2026-52859 CVE-2026-52860 CVE-2026-55693 CVE-2026-55892 CVE-2026-55895 CVE-2026-57452 CVE-2026-57455 CVE-2026-57456 CVE-2026-59856 CVE-2026-59857 CVE-2026-59858 CVE-2026-73072 CVE-2026-73073 CVE-2026-73076 CVE-2026-73077 CVE-2026-73078}
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/014810e9f87c8db682a5904de7cdfbf28c2c1fe2
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/014810e9f87c8db682a5904de7cdfbf28c2c1fe2
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261102/38502dd5/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list