[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Mon Nov 2 15:29:56 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
848b1069 by Moritz Muehlenhoff at 2026-11-02T16:28:44+01:00
trixie triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -835,21 +835,25 @@ CVE-2026-119342 (Stirling-PDF is a locally hosted web application that facilitat
NOT-FOR-US: Stirling-PDF
CVE-2026-119341 (Tesseract is an open source OCR engine. Prior to 5.5.4, ReadAdaptedCla ...)
- tesseract <unfixed> (bug #1152789)
+ [trixie] - tesseract <no-dsa> (Minor issue)
NOTE: https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-357f-833m-3f83
NOTE: https://github.com/tesseract-ocr/tesseract/pull/4645
NOTE: Fixed by: https://github.com/tesseract-ocr/tesseract/commit/614e971036d2b95d521057ff63d68d6612429b23 (5.5.4)
CVE-2026-119340 (Tesseract is an open source OCR engine. Prior to 5.5.4, GENERIC_2D_ARR ...)
- tesseract <unfixed> (bug #1152789)
+ [trixie] - tesseract <no-dsa> (Minor issue)
NOTE: https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-6xhq-wvww-6xfg
NOTE: https://github.com/tesseract-ocr/tesseract/pull/4649
NOTE: Fixed by: https://github.com/tesseract-ocr/tesseract/commit/048e92378f1a34dcdaf94bc515c7552ac01f08ef (5.5.4)
CVE-2026-119339 (Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix:: ...)
- tesseract <unfixed> (bug #1152789)
+ [trixie] - tesseract <no-dsa> (Minor issue)
NOTE: https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-h9g4-frjx-6cj3
NOTE: https://github.com/tesseract-ocr/tesseract/pull/4657
NOTE: Fixed by: https://github.com/tesseract-ocr/tesseract/commit/c053424327352b9d5180aa7540c1f9e67c64f27e (5.5.4)
CVE-2026-119338 (Tesseract is an open source OCR engine. From 5.4.0 until 5.5.4, Append ...)
- tesseract <unfixed> (bug #1152789)
+ [trixie] - tesseract <no-dsa> (Minor issue)
NOTE: https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j
NOTE: https://github.com/tesseract-ocr/tesseract/pull/4647
NOTE: Fixed by: https://github.com/tesseract-ocr/tesseract/commit/fa52414ff1fd13ae4b00048d2498f9141b0bc2eb (5.5.4)
@@ -1405,8 +1409,9 @@ CVE-2026-119601 (AFFLIB through 3.7.22 contains a heap out-of-bounds write vulne
NOTE: https://github.com/sshock/AFFLIBv3/issues/61
NOTE: Fixed by: https://github.com/sshock/AFFLIBv3/commit/04e75b65257c8e43cd911cb669b49b26edd4283e (v3.7.23)
CVE-2026-119600 (tcpflow through 1.6.1 contains an out-of-bounds read vulnerability tha ...)
- - tcpflow <unfixed>
+ - tcpflow <unfixed> (unimportant)
NOTE: https://github.com/simsong/tcpflow/issues/279
+ NOTE: Crash in GUI/CLI tool, no security impact
CVE-2026-119599 (AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerabi ...)
NOT-FOR-US: AxonHub
CVE-2026-119598 (Miaomiaowu before 0.9.3 contains an insecure direct object reference v ...)
@@ -1417,6 +1422,7 @@ CVE-2026-119596 (UNIT3D through 9.2.0 contains a missing authorization vulnerabi
NOT-FOR-US: UNIT3D
CVE-2026-119591 (SQLite before 3.54.0 contains a stack exhaustion vulnerability in coun ...)
- sqlite3 <unfixed> (bug #1152790)
+ [trixie] - sqlite3 <no-dsa> (Minor issue)
NOTE: https://sqlite.org/bugs/info/2026-10-04T05:34:47Z
NOTE: https://sqlite.org/src/info/ab621a3e11ee4acc
NOTE: https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2 (version-3.54.0)
@@ -1547,15 +1553,18 @@ CVE-2026-119407 (Element Web and Element Desktop before 1.12.32 accept guest cre
NOT-FOR-US: Element
CVE-2026-119379 (SQLite before 3.54.0 built with the session extension contains a heap ...)
- sqlite3 <unfixed> (bug #1152790)
+ [trixie] - sqlite3 <no-dsa> (Minor issue)
NOTE: https://sqlite.org/bugs/info/2026-08-16T10:15:25Z
NOTE: https://sqlite.org/src/info/3f57024aecea0f3b
NOTE: Fixed by: https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52 (version-3.54.0)
CVE-2026-119378 (SQLite before 3.54.0 contains a use-after-free vulnerability in the R- ...)
- sqlite3 <unfixed> (bug #1152790)
+ [trixie] - sqlite3 <no-dsa> (Minor issue)
NOTE: https://sqlite.org/src/info/6a9e1415659f9e75
NOTE: Fixed by: https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04 (version-3.54.0)
CVE-2026-119377 (SQLite before 3.54.0 contains an authorization bypass vulnerability in ...)
- sqlite3 <unfixed> (bug #1152790)
+ [trixie] - sqlite3 <no-dsa> (Minor issue)
NOTE: https://sqlite.org/bugs/info/2026-07-05T08:15:45Z
NOTE: https://sqlite.org/src/info/bbd69ce274620008
NOTE: Fixed by: https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237 (version-3.54.0)
@@ -1563,30 +1572,36 @@ CVE-2026-119377 (SQLite before 3.54.0 contains an authorization bypass vulnerabi
NOTE: Fixed by: https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8 (version-3.54.0)
CVE-2026-119376 (SQLite before 3.54.0 contains a stack exhaustion vulnerability that al ...)
- sqlite3 <unfixed> (bug #1152790)
+ [trixie] - sqlite3 <no-dsa> (Minor issue)
NOTE: https://sqlite.org/bugs/info/2026-10-04T04:50:56Z
NOTE: https://sqlite.org/src/info/252c0b7bf5a727d2
NOTE: Fixed by: https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2 (version-3.54.0)
CVE-2026-119375 (SQLite before 3.54.0 contains an information disclosure vulnerability ...)
- sqlite3 <unfixed> (bug #1152790)
+ [trixie] - sqlite3 <no-dsa> (Minor issue)
NOTE: https://sqlite.org/bugs/info/2026-08-17T15:54:41Z
NOTE: https://sqlite.org/src/info/f9b4ee369557c36c
NOTE: Fixed by: https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e (version-3.54.0)
CVE-2026-119374 (SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow i ...)
- sqlite3 <unfixed> (bug #1152790)
+ [trixie] - sqlite3 <no-dsa> (Minor issue)
NOTE: https://sqlite.org/src/info/9cd4f9e920
NOTE: Fixed by: https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9 (version-3.54.0)
CVE-2026-119373 (SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow i ...)
- sqlite3 <unfixed> (bug #1152790)
+ [trixie] - sqlite3 <no-dsa> (Minor issue)
NOTE: https://sqlite.org/bugs/info/2026-08-04T08:49:27Z
NOTE: https://sqlite.org/src/info/a7f8c92f62
NOTE: Fixed by: https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80 (version-3.54.0)
CVE-2026-119372 (SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PAREN ...)
- sqlite3 <unfixed> (bug #1152790)
+ [trixie] - sqlite3 <no-dsa> (Minor issue)
NOTE: https://sqlite.org/bugs/info/2026-08-17T09:18:24Z
NOTE: https://sqlite.org/src/info/e4635c4153
NOTE: Fixed by: https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731 (version-3.54.0)
CVE-2026-119371 (SQLite before 3.54.0 contains a stack exhaustion vulnerability that al ...)
- sqlite3 <unfixed> (bug #1152790)
+ [trixie] - sqlite3 <no-dsa> (Minor issue)
NOTE: https://sqlite.org/bugs/info/2026-10-04T04:58:58Z
NOTE: https://sqlite.org/src/info/f54730871303e655
NOTE: Fixed by: https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb (version-3.54.0)
@@ -1738,10 +1753,12 @@ CVE-2026-116130 (HTTP::Parser::XS versions before 0.18 for Perl truncate PATH_IN
NOTE: Fixed by: https://github.com/kazuho/p5-http-parser-xs/commit/f388b9d7994722b01edd03d57de7d2fb819e1aae (0.18)
CVE-2026-116128 (Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustio ...)
- starlet 0.33-1 (bug #1152634)
+ [trixie] - starlet <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44760434/
NOTE: Fixed by: https://github.com/kazuho/Starlet/commit/f3472712fff64329a43d86368768d80b61714106 (0.33)
CVE-2026-116127 (Starlet versions before 0.33 for Perl send a body in responses to HEAD ...)
- starlet 0.33-1 (bug #1152634)
+ [trixie] - starlet <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44760435/
NOTE: Fixed by: https://github.com/kazuho/Starlet/commit/859e0c9572cdbed4bb45706d3957b3c025dc0ede (0.33)
CVE-2026-115947 (Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.)
@@ -1750,10 +1767,12 @@ CVE-2026-115869 (The Themify Builder plugin for WordPress is vulnerable to Store
NOT-FOR-US: WordPress plugin
CVE-2026-115866 (Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion v ...)
- starlet 0.33-1 (bug #1152634)
+ [trixie] - starlet <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44760437/
NOTE: Fixed by: https://github.com/kazuho/Starlet/commit/229ea56b3b50028e2a644156317e8d0e7cf68a1f (0.33)
CVE-2026-115865 (Starlet versions before 0.33 for Perl allow a request declaring a larg ...)
- starlet 0.33-1 (bug #1152634)
+ [trixie] - starlet <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44760439/
NOTE: Fixed by: https://github.com/kazuho/Starlet/commit/598947ac620fd31b390335c683d79fa244770782 (0.33)
CVE-2026-115820 (The Majestic Support \u2013 The Leading-Edge Help Desk & Customer Supp ...)
@@ -3128,6 +3147,7 @@ CVE-2026-118765 (Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, a
NOTE: Fixed by: https://github.com/randombit/botan/commit/a7389222ace990604b6985add91ee06f55a80c0e (3.13.0)
CVE-2026-118764 (minimatch is a minimal matching utility for converting glob expression ...)
- node-minimatch <unfixed> (bug #1152691)
+ [trixie] - node-minimatch <no-dsa> (Minor issue)
NOTE: https://github.com/isaacs/minimatch/security/advisories/GHSA-g3hv-75wg-m249
NOTE: Fixed by: https://github.com/isaacs/minimatch/commit/77a0f5c4b80bdc641c3c930a1d9edf5ad2db57f8 (v11.0.1)
CVE-2026-118763 (sigstore-js provides JavaScript libraries for interacting with Sigstor ...)
@@ -42418,12 +42438,15 @@ CVE-2026-104042 (A flaw was found in sssd. A local attacker can cause a Denial o
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478862
CVE-2026-104041 (A flaw was found in SSSD. An unprivileged local user can repeatedly re ...)
- sssd <unfixed> (bug #1150238)
+ [trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478864
CVE-2026-104040 (A flaw was found in SSSD. When configured with the Entra ID identity p ...)
- sssd <unfixed> (bug #1150238)
+ [trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478915
CVE-2026-104039 (A flaw was found in SSSD. A local user can cause a denial of service ( ...)
- sssd <unfixed> (bug #1150238)
+ [trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478956
CVE-2026-104038 (A flaw was found in sssd. A remote attacker can cause a denial of serv ...)
- sssd <unfixed> (bug #1150238)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/848b10690a0add8de91a252ed75f955ebea77ac4
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/848b10690a0add8de91a252ed75f955ebea77ac4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261102/ed00caaf/attachment.htm>
More information about the debian-security-tracker-commits
mailing list