[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Tue Nov 3 12:52:24 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
bb58c4ec by Moritz Muehlenhoff at 2026-11-03T13:52:09+01:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -1276,9 +1276,11 @@ CVE-2026-74759 (Google::Auth versions 0.12 for Perl allow server side request fo
NOT-FOR-US: Google::Auth Perl module
CVE-2026-XXXX [GHSA-7pq7-3pmj-9wp6: Union-mode checkout follows an attacker-planted symlink and writes outside the destination]
- ostree 2026.6-1
+ [trixie] - ostree <no-dsa> (Minor issue)
NOTE: https://github.com/ostreedev/ostree/security/advisories/GHSA-7pq7-3pmj-9wp6
CVE-2026-XXXX [GHSA-cp2j-qv7x-wcw4: ostree: a crafted whiteout filename strips to .. so a --whiteouts checkout deletes the parent directory of the destination]
- ostree 2026.6-1
+ [trixie] - ostree <no-dsa> (Minor issue)
NOTE: https://github.com/ostreedev/ostree/security/advisories/GHSA-cp2j-qv7x-wcw4
CVE-2026-XXXX [GHSA-xwcv-cp39-m2w4]
- libheif <unfixed>
@@ -2765,7 +2767,9 @@ CVE-2026-111498 (OpenManage Enterprise, versions prior to 4.8.0, contains an Imp
NOT-FOR-US: Dell / EMC
CVE-2026-111487 (An out-of-bounds write vulnerability in the Qt Framework assimp scene ...)
- qt6-3d <unfixed>
+ [trixie] - qt6-3d <no-dsa> (Minor issue)
- qt3d-opensource-src <unfixed>
+ [trixie] - qt3d-opensource-src <no-dsa> (Minor issue)
NOTE: https://github.com/qt/qt3d/commit/1eefe29327c5d7dd6020c5dd0735eb8e5e798f05
NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-111487
CVE-2026-110972 (P\u0142atnik performs client-side authentication. An attacker with acc ...)
@@ -4539,39 +4543,46 @@ CVE-2026-XXXX [GHSA-p8g6-qw5j-8cgc: Local users can run code as root when Tigris
NOTE: https://github.com/creativeheadz/tigris/security/advisories/GHSA-p8g6-qw5j-8cgc
CVE-2026-7180
- qemu 1:11.1.3+ds-1
+ [trixie] - qemu <no-dsa> (Minor issue)
NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3729
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/e118248d9c92632204d5fda61fbf629b9ef856f4 (v11.1.3)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1492ccd15a3e0edbe66fde31c80653f699fe455f (v10.0.15)
CVE-2026-18204
- qemu 1:11.1.3+ds-1
+ [trixie] - qemu <no-dsa> (Minor issue)
NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/4086
NOTE: Introduced with: https://gitlab.com/qemu-project/qemu/-/commit/367071447ec5b0dabc5452384bbeb62371838112 (v0.15.0-rc0)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/43a624d2753d73116db570e5bb238b9b5c9bb016 (v11.1.3)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/74ee55b345c38d3f36965ac83c1b5fc5b6c49ab8 (v10.0.15)
CVE-2026-18410
- qemu 1:11.1.3+ds-1
+ [trixie] - qemu <no-dsa> (Minor issue)
NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3997
NOTE: Introduced with: https://gitlab.com/qemu-project/qemu/-/commit/367071447ec5b0dabc5452384bbeb62371838112 (v0.15.0-rc0)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/67cd05f4bb6090bea0d97cd2534d5e7c2a3e3e9a (v11.1.3)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/d5b0c53ef65ab2b0da9a42d77843b268459ccbe1 (v10.0.15)
CVE-2026-18609
- qemu 1:11.1.3+ds-1
+ [trixie] - qemu <no-dsa> (Minor issue)
NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/4128
NOTE: Introduced with: https://gitlab.com/qemu-project/qemu/-/commit/367071447ec5b0dabc5452384bbeb62371838112 (v0.15.0-rc0)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/4823a3093b3542834e1a4103a37f4ed9f4ad3c44 (v11.1.3)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/b4db9809f874eb6ad21d35d5b84337468d0d2cb3 (v10.0.15)
CVE-2026-97889
- qemu 1:11.1.3+ds-1
+ [trixie] - qemu <no-dsa> (Minor issue)
NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/4579
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/64c20eeb9962957c01ab993177a9c07890f73930 (v11.1.3)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/b2ddd7f25f68dbeeef656a9a839991c0caf55135 (v10.0.15)
CVE-2026-101291
- qemu 1:11.1.3+ds-1
+ [trixie] - qemu <no-dsa> (Minor issue)
NOTE: Introduced with: https://gitlab.com/qemu-project/qemu/-/commit/2d1d0e70cf3eadca967427e71b2c5c7d031bc5c8 (v2.6.0-rc0)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/68df2cefcfe6eb3df4c0531cea4d9125742bc9df (v11.1.3)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/fddbc5808a066f2204089dddd0b41456ae1cfdb2 (v10.0.15)
CVE-2026-111819
- qemu 1:11.1.3+ds-1
+ [trixie] - qemu <no-dsa> (Minor issue)
NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/4625
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/d8cc56e9a28d4d95b43b681e373b77f6ec247a7e (v11.1.3)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/bbe891ad260612c04f9a41af533ac2a931ce3247 (v10.0.15)
@@ -4812,6 +4823,7 @@ CVE-2026-118650 (Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, a global
NOTE: Fixed by: https://github.com/labstack/echo/commit/fc410094b2f3415cf2bf5204082137b205bfd5af (v5.4.0)
CVE-2026-118590 (A security vulnerability has been detected in nipy nibabel up to 5.4.2 ...)
- nibabel <unfixed>
+ [trixie] - nibabel <no-dsa> (Minor issue)
NOTE: https://github.com/nipy/nibabel/issues/1566
NOTE: https://github.com/nipy/nibabel/pull/1587
CVE-2026-118589 (A weakness has been identified in nschloe meshio up to 5.3.5. Impacted ...)
@@ -10275,6 +10287,7 @@ CVE-2026-111422 (In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOpera
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-110910 (### Summary `qs.stringify` with `allowEmptyArrays: true` writes the ...)
- node-qs <unfixed>
+ [trixie] - node-qs <no-dsa> (Minor issue)
NOTE: https://github.com/ljharb/qs/security/advisories/GHSA-w4cr-vjpx-p82q
NOTE: https://github.com/ljharb/qs/issues/626
CVE-2026-106174 (A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7. ...)
@@ -14032,6 +14045,7 @@ CVE-2026-111594 (InterSystems IRIS for Health has TLS/SSL encryption turned off
NOT-FOR-US: InterSystems IRIS
CVE-2026-111181 (body-parser is body parsing middleware for Node.js and Express. In ver ...)
- node-body-parser 2.4.0+~1.19.6-1 (bug #1151838)
+ [trixie] - node-body-parser <no-dsa> (Minor issue)
NOTE: https://github.com/expressjs/body-parser/security/advisories/GHSA-27r3-jxmh-p828
CVE-2026-111100 (The ONVIF device service on the E3 responds to certain informational r ...)
NOT-FOR-US: E3
=====================================
data/dsa-needed.txt
=====================================
@@ -176,6 +176,8 @@ tomcat11
weechat
Upstream recommends to use branch from https://github.com/weechat/weechat/commits/4.6/, cf #1142597
--
+xen (jmm)
+--
xorg-server (carnil)
--
zlib (carnil)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bb58c4ec546f2a81d203585b4d33ce6e5bef00b6
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bb58c4ec546f2a81d203585b4d33ce6e5bef00b6
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261103/8acf845c/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list