[Git][security-tracker-team/security-tracker][master] symfony, imagemagick DSAs

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0f7344bc by Moritz Mühlenhoff at 2026-11-04T22:42:08+01:00
symfony, imagemagick DSAs

- - - - -


3 changed files:

- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -47072,7 +47072,6 @@ CVE-2026-105090 (Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. T
 CVE-2026-105083 (ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vul ...)
 	{DLA-4875-1}
 	- imagemagick 8:7.1.2.33+dfsg1-1 (bug #1149969)
-	[trixie] - imagemagick <no-dsa> (Minor issue)
 	NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-jjp4-3fwf-393j
 	NOTE: Fixed by: [1/5] https://github.com/ImageMagick/ImageMagick/commit/1926ccf119141c26274c120d1899dffae19b0c71 (7.1.2-32)
 	NOTE: Fixed by: [2/5] https://github.com/ImageMagick/ImageMagick/commit/3cb153f2112a183316769387e52d784b87ce877d (7.1.2-32)


=====================================
data/DSA/list
=====================================
@@ -1,3 +1,9 @@
+[04 Nov 2026] DSA-6612-1 symfony - security update
+	{CVE-2026-45070 CVE-2026-108082 CVE-2026-109413 CVE-2026-109449}
+	[trixie] - symfony 6.4.49+dfsg-0+deb13u1
+[04 Nov 2026] DSA-6611-1 imagemagick - security update
+	{CVE-2026-105081 CVE-2026-105083 CVE-2026-109258 CVE-2026-109259 CVE-2026-109260 CVE-2026-109262 CVE-2026-109263 CVE-2026-109264 CVE-2026-109265 CVE-2026-109266 CVE-2026-109267 CVE-2026-109268 CVE-2026-109269 CVE-2026-109270 CVE-2026-109272 CVE-2026-109273 CVE-2026-109274 CVE-2026-109275 CVE-2026-109276 CVE-2026-109277 CVE-2026-109278 CVE-2026-109279 CVE-2026-109280 CVE-2026-109281 CVE-2026-109282 CVE-2026-109964 CVE-2026-116140 CVE-2026-116141 CVE-2026-116142 CVE-2026-116143 CVE-2026-116144 CVE-2026-116145 CVE-2026-116146 CVE-2026-116147 CVE-2026-116148 CVE-2026-116149 CVE-2026-116150 CVE-2026-116151 CVE-2026-116153 CVE-2026-116154 CVE-2026-116155 CVE-2026-116156 CVE-2026-116157 CVE-2026-116158 CVE-2026-116159 CVE-2026-116160}
+	[trixie] - imagemagick 8:7.1.1.43+dfsg1-1+deb13u14
 [04 Nov 2026] DSA-6610-1 xen - security update
 	{CVE-2026-102703 CVE-2026-102704}
 	[trixie] - xen 4.20.4+63-g7abfd2bce2-0+deb13u1


=====================================
data/dsa-needed.txt
=====================================
@@ -68,9 +68,6 @@ gst-plugins-good1.0 (jmm)
 hplip
   security patches first need to be isolated
 --
-imagemagick (jmm)
-  Second update by Bastien to be reviewed
-
 --
 jackson-databind
 --
@@ -166,9 +163,6 @@ shaarli
 --
 social-auth-core
 --
-symfony (jmm)
-  Maintainer proposing an update in <e722c4a2-e912-4eb2-a7c5-59035cd24923 at tilapin.org>
---
 tomcat10
   Bastien Roucaries proposed an update for review
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0f7344bc3c7eca37f1efe5c13435a03fbf7a8e00

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0f7344bc3c7eca37f1efe5c13435a03fbf7a8e00
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261104/e83446b1/attachment-0001.htm>