[Git][security-tracker-team/security-tracker][master] 3 commits: lts: tryton-server status update

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2a664aff by Sylvain Beucler at 2026-11-04T20:41:30+01:00
lts: tryton-server status update

- - - - -
77762603 by Sylvain Beucler at 2026-11-04T20:41:34+01:00
CVE-2026-79608/xen: bookworm not-affected

cf. https://lists.debian.org/debian-lts/2026/11/msg00018.html
and the XSA

- - - - -
a14ebf62 by Sylvain Beucler at 2026-11-04T20:41:38+01:00
Reserve DLA-4881-1 for xen

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -36393,6 +36393,7 @@ CVE-2026-79609 (XPTI (Xen Page Table Isolation) was introduced to mitigate Meltd
 CVE-2026-79608 (The workaround for XSA-433 (Zenbleed, CVE-2023-20593) was later re-wor ...)
 	{DSA-6571-1}
 	- xen 4.20.4+39-gf1e1321c87-1
+	[bookworm] - xen <not-affected> (Vulnerable code introduced in 4.19.4)
 	NOTE: https://xenbits.xen.org/xsa/advisory-515.html
 CVE-2026-79607 (During Xenstore live update the state record for a Xenstore watch with ...)
 	- xen <not-affected> (Only affects Xen 4.22)
@@ -83563,17 +83564,14 @@ CVE-2026-79605
 CVE-2026-79604
 	{DSA-6571-1}
 	- xen 4.20.4+39-gf1e1321c87-1
-	[bookworm] - xen <postponed> (Minor issue)
 	NOTE: https://xenbits.xen.org/xsa/advisory-512.html
 CVE-2026-79603 (x86 PV guests can free memory pages while still keeping a stale TLB en ...)
 	{DSA-6571-1}
 	- xen 4.20.4+39-gf1e1321c87-1
-	[bookworm] - xen <postponed> (Minor issue)
 	NOTE: https://xenbits.xen.org/xsa/advisory-511.html
 CVE-2026-79602 (A guest with a PCI device assigned that has at least a BAR on the IO p ...)
 	{DSA-6571-1}
 	- xen 4.20.4+39-gf1e1321c87-1
-	[bookworm] - xen <postponed> (Minor issue)
 	NOTE: https://xenbits.xen.org/xsa/advisory-510.html
 CVE-2026-79577 (An issue in the /cas/login component of sso-master v1.0.0 allows attac ...)
 	NOT-FOR-US: sso-master
@@ -85419,7 +85417,6 @@ CVE-2026-62645 (A vulnerability has been identified in Reyrolle 7SR5 (All versio
 CVE-2026-62437 (When guests are terminated, various pieces of cleanup need carrying ou ...)
 	{DSA-6571-1}
 	- xen 4.20.4+39-gf1e1321c87-1
-	[bookworm] - xen <postponed> (Minor issue)
 	NOTE: https://xenbits.xen.org/xsa/advisory-509.html
 CVE-2026-61517 (Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command  ...)
 	NOT-FOR-US: Netis


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[04 Nov 2026] DLA-4881-1 xen - security update
+	{CVE-2026-62437 CVE-2026-79602 CVE-2026-79603 CVE-2026-79604 CVE-2026-79609 CVE-2026-79610 CVE-2026-79611 CVE-2026-102699 CVE-2026-102700 CVE-2026-102702 CVE-2026-102703 CVE-2026-102704}
+	[bookworm] - xen 4.17.7+13-g2445b30a44-0+deb12u1
 [04 Nov 2026] DLA-4880-1 apt - security update
 	{CVE-2026-109518}
 	[bookworm] - apt 2.6.2


=====================================
data/dla-needed.txt
=====================================
@@ -801,10 +801,12 @@ trafficserver
   NOTE: 20260916: it would make sense to propose for EOL,
   NOTE: 20260916: or mass-postpone all open CVEs (Beuc/front-desk)
 --
-tryton-server
+tryton-server (Sylvain Beucler)
   NOTE: 20260909: Added by Front-Desk (eamanu)
   NOTE: 20260921: Coordinate with maintainer:
   NOTE: 20260921: https://lists.debian.org/debian-lts/2026/09/threads.html#00067
+  NOTE: 20261002: Review (Beuc)
+  NOTE: 20261002: https://lists.debian.org/debian-lts/2026/10/msg00015.html
 --
 u-boot
   NOTE: 20260804: Added by Front-Desk (rouca)
@@ -855,10 +857,6 @@ wpa (andrewsh)
   NOTE: 20261004: has a trixie-security change prepared (held for reporter
   NOTE: 20261004: testing); follow it. (utkarsh/front-desk)
 --
-xen
-  NOTE: 20261014: Added by Front-Desk (charles)
-  NOTE: 20261014: In dsa-needed.txt, sync with secteam or follow DSA (charles)
---
 xorg-server
   NOTE: 20260818: Added by Front-Desk (lamby)
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/a4a6c7470589ddd03c6c58ef8b228f518708b4e2...a14ebf62b04e1b3788cf3023cab6a268ff43821e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/a4a6c7470589ddd03c6c58ef8b228f518708b4e2...a14ebf62b04e1b3788cf3023cab6a268ff43821e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261104/6dc53704/attachment-0001.htm>