[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Oct 1 22:47:58 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
57b4e000 by Salvatore Bonaccorso at 2026-10-01T23:47:47+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -254,7 +254,7 @@ CVE-2026-104056 (Authlib version 1.7.2 and below contains a vulnerability where
CVE-2026-104018 (An improper privilege management vulnerability (CWE-269) exists in the ...)
NOT-FOR-US: WindRiver
CVE-2026-103923 (KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering ...)
- - node-katex <unfixed>
+ - node-katex <unfixed> (bug #1149653)
NOTE: https://github.com/KaTeX/KaTeX/security/advisories/GHSA-238p-pmpm-9mq7
NOTE: https://github.com/KaTeX/KaTeX/pull/4260
NOTE: Fixed by: https://github.com/KaTeX/KaTeX/commit/0adf7e77db6915d991803b29699f82b1ccf8d4f4 (v0.18.2)
@@ -994,39 +994,39 @@ CVE-2023-54403 (Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file re
CVE-2023-54402 (iDocView contains a server-side request forgery vulnerability in its / ...)
NOT-FOR-US: iDocView
CVE-2026-XXXX [GHSA-5pww-8rfg-9crf: RFC 2231 filename* parameter bypasses multipart filename rules]
- - modsecurity <unfixed>
+ - modsecurity <unfixed> (bug #1149651)
- modsecurity-apache <unfixed>
NOTE: https://github.com/advisories/GHSA-5pww-8rfg-9crf
NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
CVE-2026-XXXX [GHSA-4j47-8qcr-jf59: t:base64DecodeExt does not decode - and _, bypassing rules on URL-safe encoded payloads]
- - modsecurity <unfixed>
+ - modsecurity <unfixed> (bug #1149651)
- modsecurity-apache <unfixed>
NOTE: https://github.com/advisories/GHSA-4j47-8qcr-jf59
NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
CVE-2026-XXXX [GHSA-qrch-pjfr-9g47: t:removeComments mishandles the character after a comment terminator, bypassing rules]
- - modsecurity <unfixed>
+ - modsecurity <unfixed> (bug #1149651)
- modsecurity-apache <unfixed>
NOTE: https://github.com/advisories/GHSA-qrch-pjfr-9g47
NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
CVE-2026-XXXX [GHSA-5m93-4h75-3p2w: @rxGlobal PCRE2 error handling: match-limit fail-open and invalid-pattern crash]
- - modsecurity <unfixed>
+ - modsecurity <unfixed> (bug #1149651)
NOTE: https://github.com/advisories/GHSA-5m93-4h75-3p2w
NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
CVE-2026-73856 [GHSA-vmg8-j66p-vgvw: Response body inspection bypass via non-canonical Content-Type casing]
- - modsecurity <unfixed>
+ - modsecurity <unfixed> (bug #1149651)
NOTE: https://github.com/advisories/GHSA-vmg8-j66p-vgvw
NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
CVE-2026-73857 [GHSA-jx3r-phvx-2jmj: XML request body processor dereferences an uninitialized parser context pointer]
- - modsecurity <unfixed>
+ - modsecurity <unfixed> (bug #1149651)
NOTE: https://github.com/advisories/GHSA-jx3r-phvx-2jmj
NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
CVE-2026-61813 [GHSA-2vqc-36qp-ccmw: Weak libcurl TLS hostname verification setting when fetching over HTTPS]
- - modsecurity <unfixed>
+ - modsecurity <unfixed> (bug #1149651)
- modsecurity-apache <unfixed>
NOTE: https://github.com/advisories/GHSA-2vqc-36qp-ccmw
NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
CVE-2026-61812 [GHSA-cxqf-vgrr-xxrv: HTML decoder missing entities, leading to evasion]
- - modsecurity <unfixed>
+ - modsecurity <unfixed> (bug #1149651)
- modsecurity-apache <unfixed>
NOTE: https://github.com/advisories/GHSA-cxqf-vgrr-xxrv
NOTE: https://modsecurity.org/20260928/security-update-digest-overview-of-recent-advisory-fixes-2026-september/
@@ -3651,7 +3651,7 @@ CVE-2026-103041 (LightLLM through 1.2.0 multimodal deployments expose an unauthe
CVE-2026-103040 (LightLLM through 1.2.0 contains a remote code execution vulnerability ...)
NOT-FOR-US: LightLLM
CVE-2026-102938 (virtualenv is a tool for creating isolated virtual python environments ...)
- - python-virtualenv <unfixed>
+ - python-virtualenv <unfixed> (bug #1149650)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g
NOTE: https://github.com/pypa/virtualenv/pull/3247
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140 (21.7.11)
@@ -3662,12 +3662,12 @@ CVE-2026-102937 (virtualenv is a tool for creating isolated virtual python envir
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6 (21.7.12)
NOTE: Only impact activate.bat when running on Windows
CVE-2026-102930 (virtualenv is a tool for creating isolated virtual python environments ...)
- - python-virtualenv <unfixed>
+ - python-virtualenv <unfixed> (bug #1149650)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45
NOTE: https://github.com/pypa/virtualenv/pull/3251
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d (21.7.12)
CVE-2026-102925 (virtualenv is a tool for creating isolated virtual python environments ...)
- - python-virtualenv <unfixed>
+ - python-virtualenv <unfixed> (bug #1149650)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2
NOTE: https://github.com/pypa/virtualenv/pull/3252
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6 (21.7.13)
@@ -3884,35 +3884,35 @@ CVE-2026-102305 (UI misrepresentation in SignIn in Google Chrome on on iOS prior
{DSA-6535-1}
- chromium 154.0.8037.92-1
CVE-2026-94053 (Authentication bypass via LDAP injection in component sshd-ldap in Apa ...)
- - libmina-sshd-java <unfixed>
+ - libmina-sshd-java <unfixed> (bug #1149652)
[trixie] - libmina-sshd-java <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/09/29/39
CVE-2026-94052 (A missing check in LdapPasswordAuthenticator in component sshd-ldap in ...)
- - libmina-sshd-java <unfixed>
+ - libmina-sshd-java <unfixed> (bug #1149652)
[trixie] - libmina-sshd-java <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/09/29/38
CVE-2026-94029 (Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and ...)
- - libmina-sshd-java <unfixed>
+ - libmina-sshd-java <unfixed> (bug #1149652)
[trixie] - libmina-sshd-java <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/09/29/37
CVE-2026-94002 (Possible memory exhaustion in SFTP clients (DefaultSftpClient) in comp ...)
- - libmina-sshd-java <unfixed>
+ - libmina-sshd-java <unfixed> (bug #1149652)
[trixie] - libmina-sshd-java <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/09/29/36
CVE-2026-93996 (Uncontrolled resource consumption in component ssd-scp in Apache MINA ...)
- - libmina-sshd-java <unfixed>
+ - libmina-sshd-java <unfixed> (bug #1149652)
[trixie] - libmina-sshd-java <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/09/29/35
CVE-2026-93995 (Improper input validation in sshd-git in Apache MINA SSHD, versions up ...)
- - libmina-sshd-java <unfixed>
+ - libmina-sshd-java <unfixed> (bug #1149652)
[trixie] - libmina-sshd-java <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/09/29/34
CVE-2026-93994 (Apache MINA SSHD is a Java library for client-side and server-side SSH ...)
- - libmina-sshd-java <unfixed>
+ - libmina-sshd-java <unfixed> (bug #1149652)
[trixie] - libmina-sshd-java <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/09/29/33
CVE-2026-77185 (Authentication bypass in sshd-core in Apache MINA SSHD versions 2.0.0 ...)
- - libmina-sshd-java <unfixed>
+ - libmina-sshd-java <unfixed> (bug #1149652)
[trixie] - libmina-sshd-java <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/09/29/32
CVE-2026-98164 (In the Linux kernel, the following vulnerability has been resolved: K ...)
@@ -5163,21 +5163,21 @@ CVE-2026-102279 (Laravel is a web application framework. Prior to 12.69.0 and 13
NOTE: https://github.com/laravel/framework/pull/61381
NOTE: Fixed by: https://github.com/laravel/framework/commit/b495ca2ec4e15a977e8700328bf13e8a79f29d12 (v12.69.0)
CVE-2026-102278 (The brace-expansion library generates arbitrary strings containing a c ...)
- - node-brace-expansion <unfixed>
+ - node-brace-expansion <unfixed> (bug #1149649)
NOTE: https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c (v5.0.11)
NOTE: Fxied by: https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db (v3.0.8)
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/1ba3c71f89fb3448c8be6dcf2d17b543c2738f16 (v2.1.6)
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/1efee7c397c191da6287a78ec19512476a966a7b (v1.1.20)
CVE-2026-102277 (The brace-expansion library generates arbitrary strings containing a c ...)
- - node-brace-expansion <unfixed>
+ - node-brace-expansion <unfixed> (bug #1149649)
NOTE: https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96 (v5.0.12)
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364 (v3.0.9)
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/bdff773f98e5988616b7039cc9b508df5d640b22 (v2.1.7)
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/ffdfa3e3806bed17c0874b8f1439b084de354a7e (v1.1.21)
CVE-2026-102276 (The brace-expansion library generates arbitrary strings containing a c ...)
- - node-brace-expansion <unfixed>
+ - node-brace-expansion <unfixed> (bug #1149649)
NOTE: https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3 (v5.0.10)
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c (v3.0.7)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57b4e0007f4787f0c33f40a05a5ebeb4bdb8f560
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57b4e0007f4787f0c33f40a05a5ebeb4bdb8f560
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261001/8b116630/attachment.htm>
More information about the debian-security-tracker-commits
mailing list