[Git][security-tracker-team/security-tracker][master] qt triage

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
00549b6a by Moritz Muehlenhoff at 2026-11-02T22:44:23+01:00
qt triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -20117,6 +20117,16 @@ CVE-2026-8168 (Uncontrolled recursion in the SVG parser and renderer of the Qt S
 	- qtsvg-opensource-src <unfixed>
 	[trixie] - qtsvg-opensource-src <no-dsa> (Minor issue)
 	NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-8168:
+	NOTE: https://codereview.qt-project.org/c/qt/qtsvg/+/730591
+	NOTE: https://codereview.qt-project.org/c/qt/qtsvg/+/730501
+	NOTE: https://codereview.qt-project.org/c/qt/qtsvg/+/731257
+	NOTE: https://codereview.qt-project.org/c/qt/qtsvg/+/730892
+	NOTE: https://codereview.qt-project.org/c/qt/qtsvg/+/733245
+	NOTE: https://codereview.qt-project.org/c/qt/qtsvg/+/738811
+	NOTE: https://codereview.qt-project.org/c/qt/qtsvg/+/730590
+	NOTE: https://codereview.qt-project.org/c/qt/qtsvg/+/743488
+	NOTE: https://codereview.qt-project.org/c/qt/qtsvg/+/748966
+	NOTE: https://codereview.qt-project.org/c/qt/qtsvg/+/756512
 CVE-2026-88901 (Improper Restriction of XML External Entity Reference vulnerability in ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-88900 (Deserialization of Untrusted Data vulnerability in Apache Camel Camel- ...)
@@ -196525,11 +196535,10 @@ CVE-2026-6344 (The Fluent Forms plugin for WordPress is vulnerable to Arbitrary
 CVE-2026-6210 (A type confusion vulnerability in Qt SVG allows an attacker to cause a ...)
 	- qt6-svg 6.10.2-6 (bug #1136089)
 	[trixie] - qt6-svg <no-dsa> (Minor issue)
-	[bookworm] - qt6-svg <no-dsa> (Minor issue)
-	- qtsvg-opensource-src <unfixed>
-	[trixie] - qtsvg-opensource-src <no-dsa> (Minor issue)
-	[bookworm] - qtsvg-opensource-src <no-dsa> (Minor issue)
+	[bookworm] - qt6-svg <not-affected> (Vulnerable code not present, only affects 6.7 and later))
+	- qtsvg-opensource-src <not-affected> (Only affects 6.7 and later)
 	NOTE: https://codereview.qt-project.org/c/qt/qtsvg/+/724887
+	NOTE: Introduced in 6.7.0 with https://codereview.qt-project.org/c/qt/qtsvg/+/492578
 CVE-2026-43975 (FolderUploadsFileManager in Apache Wicket does not validate or sanitiz ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-43646 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/00549b6aefd23cfa1d643886850ed1d6bbbb7d28

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/00549b6aefd23cfa1d643886850ed1d6bbbb7d28
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261102/b7ad84ae/attachment.htm>