[Git][security-tracker-team/security-tracker][master] record various fixed versions for older unimportant issues, thanks to Sumit Verma
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Tue Nov 3 19:22:13 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
01aacb3a by Moritz Muehlenhoff at 2026-11-03T20:22:05+01:00
record various fixed versions for older unimportant issues, thanks to Sumit Verma
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -67258,7 +67258,7 @@ CVE-2026-82561 (Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that r
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-81872 (OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to v ...)
[experimental] - golang-opentelemetry-otel 1.46.0-1~exp1
- - golang-opentelemetry-otel <unfixed> (bug #1149049)
+ - golang-opentelemetry-otel 1.46.0-2 (bug #1149049)
[trixie] - golang-opentelemetry-otel <no-dsa> (Minor issue)
[bookworm] - golang-opentelemetry-otel <not-affected> (Vulnerable code introduced in 1.26.0)
NOTE: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65
@@ -194605,10 +194605,10 @@ CVE-2026-8258 (A flaw has been found in Squirrel up to 3.2. Impacted is the func
[bullseye] - squirrel3 <postponed> (Minor issue)
NOTE: https://github.com/albertodemichelis/squirrel/issues/325
CVE-2026-8257 (A vulnerability was detected in WebAssembly Binaryen up to 117. This i ...)
- - binaryen <unfixed> (unimportant)
+ - binaryen 130-2 (unimportant)
NOTE: https://github.com/WebAssembly/binaryen/issues/8633
NOTE: https://github.com/WebAssembly/binaryen/pull/8635
- NOTE: Fixed by: https://github.com/WebAssembly/binaryen/commit/1251efbc1ea471c1311d2726b2bbe061ff2a291c
+ NOTE: Fixed by: https://github.com/WebAssembly/binaryen/commit/1251efbc1ea471c1311d2726b2bbe061ff2a291c (version_130)
NOTE: Crash in CLI tool, no security impact
CVE-2026-8256 (A security vulnerability has been detected in Devs Palace ERP Online u ...)
NOT-FOR-US: Devs Palace ERP Online
@@ -227040,14 +227040,14 @@ CVE-2025-13995 (IBM QRadar SIEM7.5.0 through 7.5.0 Update Package 14 could allow
CVE-2024-42210 (A Stored cross-site scripting (XSS) vulnerability affects HCL Unica Ma ...)
NOT-FOR-US: HCL
CVE-2026-31973 (SAMtools is a program for reading, manipulating and writing bioinforma ...)
- - samtools <unfixed> (unimportant)
+ - samtools 1.24-2 (unimportant)
NOTE: https://github.com/samtools/samtools/security/advisories/GHSA-x86f-q6fj-cm43
- NOTE: Fixed by: https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2f
+ NOTE: Fixed by: https://github.com/samtools/samtools/commit/06fc2a219b3d7c94d3f412c09f6d1efd51199f2f (1.23.2)
NOTE: Crash in CLI tool, no security impact
CVE-2026-31972 (SAMtools is a program for reading, manipulating and writing bioinforma ...)
- - samtools <unfixed> (unimportant)
+ - samtools 1.24-2 (unimportant)
NOTE: https://github.com/samtools/samtools/security/advisories/GHSA-72c8-4jf3-f27p
- NOTE: Fixed by: https://github.com/samtools/samtools/commit/3036eb9af945fcef359427a2d359855553da4adf
+ NOTE: Fixed by: https://github.com/samtools/samtools/commit/3036eb9af945fcef359427a2d359855553da4adf (1.23)
NOTE: Crash in CLI tool, no security impact
CVE-2026-4396 (Improper certificate validation in Devolutions Hub Reporting Service ...)
NOT-FOR-US: Devolutions
@@ -230128,7 +230128,7 @@ CVE-2026-31954 (Emlog is an open source website building system. In 2.6.6 and ea
CVE-2026-31901 (Parse Server is an open source backend that can be deployed to any inf ...)
NOT-FOR-US: Parse Server
CVE-2026-31900 (Black is the uncompromising Python code formatter. Black provides a Gi ...)
- - black <unfixed> (unimportant)
+ - black 26.3.1-1 (unimportant)
NOTE: https://github.com/psf/black/security/advisories/GHSA-v53h-f6m7-xcgm
NOTE: Fixed by: https://github.com/psf/black/commit/0a2560b981364dde4c8cf8ce9d164c40669a8611 (26.3.0)
NOTE: GitHub action code from action/main.py not provided in the Debian built binay packages
@@ -265112,16 +265112,16 @@ CVE-2025-14959 (A weakness has been identified in code-projects Simple Stock Sys
CVE-2025-14958 (A security flaw has been discovered in floooh sokol up to 33e2271c431b ...)
NOT-FOR-US: floooh sokol
CVE-2025-14957 (A vulnerability was identified in WebAssembly Binaryen up to 125. This ...)
- - binaryen <unfixed> (bug #1123746; unimportant)
+ - binaryen 130-2 (bug #1123746; unimportant)
NOTE: https://github.com/WebAssembly/binaryen/issues/8090
NOTE: https://github.com/WebAssembly/binaryen/pull/8099
- NOTE: Fixed by: https://github.com/WebAssembly/binaryen/commit/6fb2b917a79578ab44cf3b900a6da4c27251e0d4
+ NOTE: Fixed by: https://github.com/WebAssembly/binaryen/commit/6fb2b917a79578ab44cf3b900a6da4c27251e0d4 (version_126)
NOTE: Crash in CLI tool, no security impact
CVE-2025-14956 (A vulnerability was determined in WebAssembly Binaryen up to 125. Affe ...)
- - binaryen <unfixed> (bug #1123745; unimportant)
+ - binaryen 130-2 (bug #1123745; unimportant)
NOTE: https://github.com/WebAssembly/binaryen/issues/8089
NOTE: https://github.com/WebAssembly/binaryen/pull/8092
- NOTE: Fixed by: https://github.com/WebAssembly/binaryen/commit/4f52bff8c4075b5630422f902dd92a0af2c9f398
+ NOTE: Fixed by: https://github.com/WebAssembly/binaryen/commit/4f52bff8c4075b5630422f902dd92a0af2c9f398 (version_126)
NOTE: Crash in CLI tool, no security impact
CVE-2025-14955 (A vulnerability was found in Open5GS up to 2.7.5. Affected by this vul ...)
- open5gs <itp> (bug #1094791)
@@ -285593,7 +285593,7 @@ CVE-2025-50950 (Audiofile v0.3.7 was discovered to contain a NULL pointer derefe
[bullseye] - audiofile <postponed> (Minor issue)
NOTE: https://github.com/mpruett/audiofile/issues/66
CVE-2025-50949 (FontForge v20230101 was discovered to contain a memory leak via the co ...)
- - fontforge <unfixed> (unimportant; bug #1118748)
+ - fontforge 1:20251009+git20260808~dfsg-1 (unimportant; bug #1118748)
NOTE: https://github.com/fontforge/fontforge/pull/5491
NOTE: Fixed by: https://github.com/fontforge/fontforge/commit/da98987fa8c896fce9a7813923f4f1c75b0d8cd3 (20251009)
NOTE: Negligible security impact
@@ -357698,13 +357698,13 @@ CVE-2025-2757 (A vulnerability classified as critical was found in Open Asset Im
NOTE: https://github.com/assimp/assimp/issues/6019
NOTE: https://github.com/assimp/assimp/commit/5be336779d81b1d71b290bc004eb5d1593c328c5 (v6.0.2)
CVE-2025-2756 (A vulnerability classified as critical has been found in Open Asset Im ...)
- - assimp <unfixed> (bug #1102227)
- [trixie] - assimp <postponed> (Minor issue, revisit when/if fixed upstream)
+ - assimp 6.0.5+ds-1 (bug #1102227)
+ [trixie] - assimp <no-dsa> (Minor issue)
[bookworm] - assimp <postponed> (Minor issue, revisit when/if fixed upstream)
[bullseye] - assimp <postponed> (Minor issue)
NOTE: https://github.com/assimp/assimp/issues/6018
NOTE: https://github.com/assimp/assimp/pull/6458
- NOTE: Fixed by: https://github.com/assimp/assimp/commit/ae6633ef8a8b686a7a080e9ad65fc77fd712e4b4
+ NOTE: Fixed by: https://github.com/assimp/assimp/commit/ae6633ef8a8b686a7a080e9ad65fc77fd712e4b4 (v6.0.5)
CVE-2025-2755 (A vulnerability was found in Open Asset Import Library Assimp 5.4.3. I ...)
- assimp <unfixed> (bug #1102226)
[trixie] - assimp <postponed> (Minor issue, revisit when/if fixed upstream)
@@ -357712,13 +357712,13 @@ CVE-2025-2755 (A vulnerability was found in Open Asset Import Library Assimp 5.4
[bullseye] - assimp <postponed> (Minor issue)
NOTE: https://github.com/assimp/assimp/issues/6017
CVE-2025-2754 (A vulnerability was found in Open Asset Import Library Assimp 5.4.3. I ...)
- - assimp <unfixed> (bug #1102225)
- [trixie] - assimp <postponed> (Minor issue, revisit when/if fixed upstream)
+ - assimp 6.0.5+ds-1 (bug #1102225)
+ [trixie] - assimp <no-dsa> (Minor issue)
[bookworm] - assimp <postponed> (Minor issue, revisit when/if fixed upstream)
[bullseye] - assimp <postponed> (Minor issue)
NOTE: https://github.com/assimp/assimp/issues/6015
NOTE: https://github.com/assimp/assimp/pull/6458
- NOTE: Fixed by: https://github.com/assimp/assimp/commit/ae6633ef8a8b686a7a080e9ad65fc77fd712e4b4
+ NOTE: Fixed by: https://github.com/assimp/assimp/commit/ae6633ef8a8b686a7a080e9ad65fc77fd712e4b4 (v6.0.5)
CVE-2025-2753 (A vulnerability was found in Open Asset Import Library Assimp 5.4.3. I ...)
- assimp <unfixed> (bug #1102224)
[trixie] - assimp <postponed> (Minor issue, revisit when/if fixed upstream)
@@ -474884,15 +474884,15 @@ CVE-2024-26462 (Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerabilit
NOTE: Fixed by: https://github.com/krb5/krb5/commit/0c2de238b5bf1ea4578e3933a604c7850905b8be (krb5-1.21.3-final)
NOTE: https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html
CVE-2024-26461 (Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in / ...)
- - krb5 <unfixed> (bug #1098754; unimportant)
+ - krb5 1.22.1-2 (bug #1098754; unimportant)
NOTE: https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_2.md
- NOTE: Fixed by: https://github.com/krb5/krb5/commit/c5f9c816107f70139de11b38aa02db2f1774ee0d
+ NOTE: Fixed by: https://github.com/krb5/krb5/commit/c5f9c816107f70139de11b38aa02db2f1774ee0d (krb5-1.22-beta1)
NOTE: Codepath cannot be triggered via API calls, negligible security impact
NOTE: https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html
CVE-2024-26458 (Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/r ...)
- - krb5 <unfixed> (bug #1098754; unimportant)
+ - krb5 1.22.1-2 (bug #1098754; unimportant)
NOTE: https://github.com/LuMingYinDetect/krb5_defects/blob/main/krb5_detect_1.md
- NOTE: Fixed by: https://github.com/krb5/krb5/commit/c5f9c816107f70139de11b38aa02db2f1774ee0d
+ NOTE: Fixed by: https://github.com/krb5/krb5/commit/c5f9c816107f70139de11b38aa02db2f1774ee0d (krb5-1.22-beta1)
NOTE: Unused codepath, negligible security impact
NOTE: https://mailman.mit.edu/pipermail/kerberos/2024-March/023095.html
CVE-2024-26455 (fluent-bit 2.2.2 contains a Use-After-Free vulnerability in /fluent-bi ...)
@@ -753110,9 +753110,9 @@ CVE-2020-12287 (Incorrect permissions in the Intel(R) Distribution of OpenVINO(T
CVE-2019-20791 (OpenThread before 2019-12-13 has a stack-based buffer overflow in Mesh ...)
NOT-FOR-US: OpenThread
CVE-2018-21232 (re2c before 2.0 has uncontrolled recursion that causes stack consumpti ...)
- - re2c <unfixed> (unimportant)
+ - re2c 3.1-1 (unimportant)
NOTE: https://github.com/skvadrik/re2c/issues/219
- NOTE: Fixed by: https://github.com/skvadrik/re2c/commit/5fffb1870181d6179118586e21ed2889b8b4abc8
+ NOTE: Fixed by: https://github.com/skvadrik/re2c/commit/5fffb1870181d6179118586e21ed2889b8b4abc8 (3.1)
NOTE: https://www.openwall.com/lists/oss-security/2020/04/27/2
NOTE: Crash im CLI tool, no security impact
CVE-2020-12286 (In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12, the Task ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/01aacb3a36c9115ec768da100e3ce15676674d2e
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/01aacb3a36c9115ec768da100e3ce15676674d2e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261103/ce89c01e/attachment.htm>
More information about the debian-security-tracker-commits
mailing list