[Git][security-tracker-team/security-tracker][master] 7 commits: dla: add and assign Utkarsh to libpng1.6
Utkarsh Gupta (@utkarsh)
utkarsh at debian.org
Fri Oct 2 02:21:13 BST 2026
Utkarsh Gupta pushed to branch master at Debian Security Tracker / security-tracker
Commits:
937cbf8a by Utkarsh Gupta at 2026-10-02T06:51:03+05:30
dla: add and assign Utkarsh to libpng1.6
- - - - -
6d83c24a by Utkarsh Gupta at 2026-10-02T06:51:03+05:30
dla-needed: add node-shell-quote
- - - - -
9441efe1 by Utkarsh Gupta at 2026-10-02T06:51:03+05:30
dla-needed: add openssl
- - - - -
d30220d8 by Utkarsh Gupta at 2026-10-02T06:51:03+05:30
dla-needed: add pcre2
- - - - -
be214af6 by Utkarsh Gupta at 2026-10-02T06:51:03+05:30
DLA-4801-1: add missing swift CVE
- - - - -
316349a7 by Utkarsh Gupta at 2026-10-02T06:51:03+05:30
dla-needed: add apache2
- - - - -
bb35cdd3 by Utkarsh Gupta at 2026-10-02T06:51:03+05:30
dla-needed: add libnet-idn-encode-perl
- - - - -
2 changed files:
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/DLA/list
=====================================
@@ -32,7 +32,7 @@
{CVE-2026-48587 CVE-2026-48588}
[bookworm] - python-django 3:3.2.25-0+deb12u5
[29 Sep 2026] DLA-4801-1 swift - security update
- {CVE-2026-71191 CVE-2026-97149}
+ {CVE-2026-71191 CVE-2026-71192 CVE-2026-97149}
[bookworm] - swift 2.30.1-0+deb12u3
[29 Sep 2026] DLA-4800-1 glance - security update
{CVE-2026-71196 CVE-2026-71197 CVE-2026-71198 CVE-2026-77648}
=====================================
data/dla-needed.txt
=====================================
@@ -61,6 +61,12 @@ antiword
NOTE: 20260917: Added by Front-Desk (Beuc)
NOTE: 20260917: Dead upstream but Debian maintainer provided patches (Beuc/front-desk)
--
+apache2
+ NOTE: 20261002: Added by Front-Desk (utkarsh)
+ NOTE: 20261002: 19 CVEs fixed in 2.4.69; bookworm ships 2.4.68. Rebase, in
+ NOTE: 20261002: step with trixie: secteam waits a grace period for 2.4.69
+ NOTE: 20261002: regressions before the DSA. (utkarsh/front-desk)
+--
bind9 (rouca)
NOTE: 20260917: Added by Front-Desk (Beuc)
NOTE: 20260917: Upcoming DSA (Beuc/front-desk)
@@ -326,6 +332,17 @@ libheif
libmojo-jwt-perl
NOTE: 20260805: Added by Front-Desk (rouca)
--
+libnet-idn-encode-perl
+ NOTE: 20261002: Added by Front-Desk (utkarsh)
+ NOTE: 20261002: 7 CVEs fixed upstream in 2.590 (#1148729), all present in
+ NOTE: 20261002: 2.500; CVE-2026-74766 is a heap use-after-free on decoding
+ NOTE: 20261002: an xn-- label. (utkarsh/front-desk)
+--
+libpng1.6 (Utkarsh)
+ NOTE: 20261002: Added by Front-Desk (utkarsh)
+ NOTE: 20261002: CVE-2026-46675, fixed for trixie in DSA-6537-1. Upstream
+ NOTE: 20261002: aa77ef38 applies to 1.6.39 as-is. (utkarsh/front-desk)
+--
libreoffice (santiago)
NOTE: 20260927: Added by Front-Desk (ta)
--
@@ -465,6 +482,13 @@ node-re2
NOTE: 20260806: Added by Front-Desk (rouca)
NOTE: 20260806: CVE-2026-68499 is worth fixing due to re2 used for fixing redos and other regex problem on backport (rouca)
--
+node-shell-quote
+ NOTE: 20261002: Added by Front-Desk (utkarsh)
+ NOTE: 20261002: CVE-2026-102422: 1.7.4 is affected despite the upstream
+ NOTE: 20261002: >= 1.8.4 range, as DSA-6300-1 backported the quote() comment
+ NOTE: 20261002: branch. Fix is upstream 6002b2ed (1.11.0). Also fix the
+ NOTE: 20261002: postponed CVE-2026-13311 with it. (utkarsh/front-desk)
+--
nodejs (rouca)
NOTE: 20260622: Added by Front-Desk (lamby)
NOTE: 20261001: Made a partial realease due to newer CVEs (rouca)
@@ -504,6 +528,13 @@ opensc
NOTE: 20260731: Added by Front-Desk (ta)
NOTE: 20260731: lots of no-dsa issues piled up (ta)
--
+openssl
+ NOTE: 20261002: Added by Front-Desk (utkarsh)
+ NOTE: 20261002: 6 CVEs from the 20260929 advisory (DSA-6531-1) affect
+ NOTE: 20261002: 3.0.22; CVE-2026-84782 (DTLS, High) is the main one. There
+ NOTE: 20261002: is no public 3.0.23, so backport from the trixie patches
+ NOTE: 20261002: or the 3.4 branch. (utkarsh/front-desk)
+--
pacemaker
NOTE: 20260618: Added by Front-Desk (charles)
NOTE: 20260618: Package is in dsa-needed (charles)
@@ -514,6 +545,11 @@ parted (charles)
pcp
NOTE: 20260801: Added by Front-Desk (ta)
--
+pcre2
+ NOTE: 20261002: Added by Front-Desk (utkarsh)
+ NOTE: 20261002: CVE-2026-103111 (JIT stack OOB write), fixed for trixie in
+ NOTE: 20261002: DSA-6530-1; that patch applies to 10.42. (utkarsh/front-desk)
+--
pdfminer
NOTE: 20260715: Added by Front-Desk (Beuc)
NOTE: 20260715: CVE-2025-70559 is follow-up fix for CVE-2025-64512
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/1c37e93f49fa950bdbcb2f664f9c8afc8133d616...bb35cdd307ca9caa9df08b432aceec1910aee340
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/1c37e93f49fa950bdbcb2f664f9c8afc8133d616...bb35cdd307ca9caa9df08b432aceec1910aee340
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/919e3f51/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list