[Git][security-tracker-team/security-tracker][master] Add new ZoneMinder issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d46e1692 by Salvatore Bonaccorso at 2026-10-01T07:22:44+02:00
Add new ZoneMinder issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2656,9 +2656,13 @@ CVE-2026-102333 (httpdbg before 2.2.1 fails to validate URL schemes in recorded
 CVE-2026-102332 (Dozzle versions before 11.1.2 fail to sanitize container display names ...)
 	NOT-FOR-US: Dozzle
 CVE-2026-102297 (ZoneMinder before 1.38.4 fails to apply per-monitor access restriction ...)
-	TODO: check
+	- zoneminder <unfixed>
+	NOTE: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-mg2g-jmfc-3w8g
+	NOTE: Fixed by: https://github.com/ZoneMinder/zoneminder/commit/aafe580b231bbeead12a110a957d85a26f7a23be (1.38.4)
 CVE-2026-102296 (ZoneMinder before 1.38.4 contains static buffer overflow vulnerabiliti ...)
-	TODO: check
+	- zoneminder <unfixed>
+	NOTE: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-93j4-rcp9-9jx6
+	NOTE: Fixed by: https://github.com/ZoneMinder/zoneminder/commit/2596e5fb64c0348e615577b0ab08dc38b6dc6ed8 (1.38.4)
 CVE-2026-102293 (A vulnerability was identified in realjerrytang tacomall 1.0.0. Impact ...)
 	NOT-FOR-US: realjerrytang tacomall
 CVE-2026-102292 (A flaw has been found in coolbeans1212 MateisHomePage-Website up to ea ...)
@@ -2857,7 +2861,9 @@ CVE-2026-100371 (InvoicePlane is a self-hosted open source application for manag
 CVE-2026-100370 (DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to vers ...)
 	NOT-FOR-US: DOMSanitizer
 CVE-2024-58386 (ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vuln ...)
-	TODO: check
+	- zoneminder <unfixed>
+	NOTE: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-8fw2-wh82-vv4h
+	NOTE: Fixed by: https://github.com/ZoneMinder/zoneminder/commit/3b379e99c0c1e539334ad4186c15ad0dc6c238b9 (1.37.65)
 CVE-2024-42002 (A code injection vulnerability has been discovered in the Robot Operat ...)
 	NOT-FOR-US: Operating System 2 (ROS 2) 'ros2topic' CLI tool
 CVE-2026-96415 (Catapult DCT2000 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d46e1692981ebe966acc12bdbc2398d789ba7d63

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d46e1692981ebe966acc12bdbc2398d789ba7d63
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261001/01c163ce/attachment.htm>