[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Oct 2 15:48:59 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
8cf51689 by Moritz Muehlenhoff at 2026-10-02T16:48:49+02:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -602,6 +602,7 @@ CVE-2026-104018 (An improper privilege management vulnerability (CWE-269) exists
NOT-FOR-US: WindRiver
CVE-2026-103923 (KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering ...)
- node-katex <unfixed> (bug #1149653)
+ [trixie] - node-katex <no-dsa> (Minor issue)
NOTE: https://github.com/KaTeX/KaTeX/security/advisories/GHSA-238p-pmpm-9mq7
NOTE: https://github.com/KaTeX/KaTeX/pull/4260
NOTE: Fixed by: https://github.com/KaTeX/KaTeX/commit/0adf7e77db6915d991803b29699f82b1ccf8d4f4 (v0.18.2)
@@ -629,14 +630,17 @@ CVE-2026-103687 (A vulnerability has been found in rhukster dom-sanitizer up to
CVE-2026-103686 (A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted ...)
NOT-FOR-US: DOMSanitizer
CVE-2026-103680 (A flaw was found in tnef. A heap-based buffer overflow can occur in th ...)
- - tnef <unfixed>
+ - tnef <unfixed> (unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2544478
+ NOTE: Crash in CLI tool, no security impact (mitigated by toolchain hardening)
CVE-2026-103679 (A flaw was found in tnef. A remote attacker could exploit this vulnera ...)
- - tnef <unfixed>
+ - tnef <unfixed> (unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2544477
+ NOTE: Crash in CLI tool, no security impact
CVE-2026-103678 (A flaw was found in tnef. An attacker can exploit this vulnerability b ...)
- - tnef <unfixed>
+ - tnef <unfixed> (unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2544476
+ NOTE: Crash in CLI tool, no security impact
CVE-2026-103664 (MISP contains a reflected cross-site scripting (XSS) vulnerability in ...)
- misp <itp> (bug #1144317)
CVE-2026-103662 (MISP contains a reflected cross-site scripting (XSS) vulnerability in ...)
@@ -1559,6 +1563,7 @@ CVE-2026-96338 (Subscriber Cross Site Scripting (XSS) in Profile Builder <= 4.0.
NOT-FOR-US: WordPress plugin or theme
CVE-2026-95616 (An integer overflow in WSS4J's DER bounds check lets an oversized allo ...)
- wss4j <unfixed>
+ [trixie] - wss4j <no-dsa> (Minor issue)
NOTE: https://lists.apache.org/thread.html/sdf0fsphkg4qbj7nh2brjgwvcmd67hct
CVE-2026-95587 (Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 ver ...)
NOT-FOR-US: WordPress plugin or theme
@@ -1644,6 +1649,7 @@ CVE-2026-93460 (A stored cross-site scripting vulnerability via appended strings
NOT-FOR-US: baserCMS
CVE-2026-92899 (Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so ...)
- wss4j <unfixed>
+ [trixie] - wss4j <no-dsa> (Minor issue)
NOTE: https://lists.apache.org/thread.html/nrzngsz1xm2lztq3t873663xx9wnrwm7
CVE-2026-92873 (Pgpool-II contains an incorrect implementation of an authentication al ...)
- pgpool2 4.7.3-1 (bug #1149670)
@@ -1670,19 +1676,23 @@ CVE-2026-92712 (The ReactPress \u2013 Create React App for WordPress plugin for
NOT-FOR-US: WordPress plugin
CVE-2026-92121 (In the WSS4J streaming (StAX) code, a signature reference using the WS ...)
- wss4j <unfixed>
+ [trixie] - wss4j <no-dsa> (Minor issue)
NOTE: https://lists.apache.org/thread.html/oop9p4hpl5o9byosb1qg3z7q1sgnn4pc
CVE-2026-91860 (A prototype pollution vulnerability exists in the deep merge helpers o ...)
NOT-FOR-US: Vaadin
CVE-2026-89238 (WSS4J EncryptedHeader child confusion could promote an attacker-contro ...)
- wss4j <unfixed>
+ [trixie] - wss4j <no-dsa> (Minor issue)
NOTE: https://lists.apache.org/thread.html/1lv4hpl8kon1ns5txjnhn2m2sh9rl22w
CVE-2026-88920 (An authentication bypass in the DOM security processor in Apache WSS4J ...)
- wss4j <unfixed>
+ [trixie] - wss4j <no-dsa> (Minor issue)
NOTE: https://lists.apache.org/thread.html/grt43m3bgbzz0mk0cnho3rcybb1j01z9
CVE-2026-88037 (The Bold Page Builder plugin for WordPress is vulnerable to Stored Cro ...)
NOT-FOR-US: WordPress plugin
CVE-2026-87830 (In the StAX streaming WS-SecurityPolicy validator, certain relative or ...)
- wss4j <unfixed>
+ [trixie] - wss4j <no-dsa> (Minor issue)
NOTE: https://lists.apache.org/thread.html/lwlozb1x20d16f9dnyvoygc9rrhzq2vn
CVE-2026-87004 (Tugtainer is a self-hosted app for automating updates of Docker contai ...)
NOT-FOR-US: Tugtainer
@@ -1690,6 +1700,7 @@ CVE-2026-86778 (Observable response discrepancy vulnerability in Maksisoft Techn
NOT-FOR-US: Maksisoft Gym
CVE-2026-85532 (Apache WSS4J accepted attacker-controlled derived-key lengths and offs ...)
- wss4j <unfixed>
+ [trixie] - wss4j <no-dsa> (Minor issue)
NOTE: https://lists.apache.org/thread.html/7jllcpbf4nbzhdp2vchz5yplnl5w6vd6
CVE-2026-82307 (Improper neutralization of special elements used in an SQL command ('S ...)
NOT-FOR-US: SOPLOG
@@ -4132,6 +4143,7 @@ CVE-2024-31026 (An issue in Greek Universities Network (GUnet) Open eClass Platf
NOT-FOR-US: Greek Universities Network (GUnet) Open eClass Platform
CVE-2026-XXXX [GHSA-5rfj-p5qw-w48g: Unauthenticated remote DoS via attacker-controlled reverse-DNS hostname in auto-hosts parsing]
- sshuttle 2.0.0-1
+ [trixie] - sshuttle <no-dsa> (Minor issue)
NOTE: https://github.com/sshuttle/sshuttle/security/advisories/GHSA-5rfj-p5qw-w48g
NOTE: Fixed by: https://github.com/sshuttle/sshuttle/commit/baea31a6769baeb52e8837ad6cc582017d74676c (v2.0.0)
CVE-2026-102331 (Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0 ...)
@@ -4285,6 +4297,7 @@ CVE-2026-96428 (SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpo
NOT-FOR-US: Flowring Agentflow
CVE-2026-95520 (A heap-based buffer overflow flaw was found in rpm. Parsing a symlink ...)
- rpm <unfixed>
+ [trixie] - rpm <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2537809
CVE-2026-19395
NOT-FOR-US: Qt for MCUs
@@ -5404,14 +5417,17 @@ CVE-2026-XXXX [groff issues]
NOTE: https://savannah.gnu.org/bugs/?68688 (private)
CVE-2026-16271 [hw/display/qxl: validate primary surface stride against width]
- qemu 1:11.1.2+ds-1
+ [trixie] - qemu <no-dsa> (Minor issue)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/f39ebe53c3f319132cfb60030de12c8547426ace (v11.1.2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/e6d0120e039a961392eea2c566a4b110884a1b60 (v10.0.14)
CVE-2026-77913 [hw/display/vga: fix text-mode OOB write after a graphics surface switch]
- qemu 1:11.1.2+ds-1
+ [trixie] - qemu <no-dsa> (Minor issue)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/f3c6a0a6dcae7b6beef21a9ee332c1c6e8035c8a (v11.1.2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/931861685366c372e1c12faf8e10786409ee4d12 (v10.0.14)
CVE-2026-84788 [io/channel-socket: do not treat a zero length write as an error]
- qemu 1:11.1.2+ds-1
+ [trixie] - qemu <no-dsa> (Minor issue)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/98b79943b28d417327e36281dca180dd2b95c75d (v11.1.2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/756836f32a394b3cd29dff540a7dd907600dc589 (v11.1.2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/a1bc6e49b357458eecd94e05ca9eea00336c4dce (v11.1.2)
@@ -5424,14 +5440,17 @@ CVE-2026-84788 [io/channel-socket: do not treat a zero length write as an error]
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/316989d81e9bb4d253c8e726d462c7bb7031d04c (v10.0.14)
CVE-2026-66900 [hw/net/virtio-net: strip trailing padding when caching RSC segment]
- qemu 1:11.1.2+ds-1
+ [trixie] - qemu <no-dsa> (Minor issue)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/ec2fdc85829a5090ebaea2f4094b9616a4ea6309 (v11.1.2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/cc48e48a3a3a836ce712305bbeeb9515900dd4ef (v10.0.14)
CVE-2026-66899 [virtio-balloon: fix free-page BH teardown on unrealize]
- qemu 1:11.1.2+ds-1
+ [trixie] - qemu <no-dsa> (Minor issue)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/f731c7d2d4cc511abba74607bea4184c207a069e (v11.1.2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/be1244c42390de95fa5201a722f3db1302ccef2d (v10.0.14)
CVE-2026-17588 [hw/usb/hcd-xhci: Set reentrancy guard in timer functions]
- qemu 1:11.1.2+ds-1
+ [trixie] - qemu <no-dsa> (Minor issue)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/ed582623e2372fdf862a804d122766052aba81c7 (v11.1.2)
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/1622c9abec17d5cba63383d4d4cb1419cedf8158 (v10.0.14)
CVE-2026-46675 [Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression]
@@ -11821,6 +11840,7 @@ CVE-2026-92284 (Caddy is an extensible server platform that uses TLS by default.
TODO: check references, refers to GHSA-j8px-rmrx-76h9 which is for CVE-2026-77281
CVE-2026-92164 (Streamlink is a CLI utility which pipes video streams from various ser ...)
- streamlink 8.6.0-1
+ [trixie] - streamlink <no-dsa> (Minor issue)
NOTE: https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v
NOTE: https://github.com/streamlink/streamlink/commit/4b99c64dde21ea70c24d9ffdbd15849b05f465c6 (8.6.0)
CVE-2026-92001 (Improper restriction of recursive entity references in DTDs ('XML enti ...)
@@ -15109,6 +15129,7 @@ CVE-2026-82187 (The Web to Print Online Designer WordPress plugin before 2.15.0
NOT-FOR-US: WordPress plugin
CVE-2026-92382 (An out-of-bounds write flaw was found in usbredir. Starting an isochro ...)
- usbredir <unfixed> (bug #1148831)
+ [trixie] - usbredir <postponed> (Revisit when fixed upstream)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2535972
TODO: check details once Red Hat opens up bugzilla entry
CVE-2026-94113 (Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contai ...)
@@ -31456,6 +31477,7 @@ CVE-2026-88021 (Consul and Consul Enterprise are vulnerable to an authorization
- consul <removed>
CVE-2026-88018 (rclone is a command-line program to sync files and directories to and ...)
- rclone <unfixed> (bug #1147404)
+ [trixie] - rclone <no-dsa> (Minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-xwwr-4h3p-r22c
NOTE: Fixed by: https://github.com/rclone/rclone/commit/90595f34f27f569be6b27c57fe5ab65057d323bd (1.75.1)
CVE-2026-88017 (rclone is a command-line program to sync files and directories to and ...)
@@ -116786,6 +116808,7 @@ CVE-2026-54503 (plone.app.textfield provides a zope.schema-style field type call
NOT-FOR-US: Plone
CVE-2026-55830 (RestrictedPython is a tool that helps to define a subset of the Python ...)
- restrictedpython 8.4-1
+ [trixie] - restrictedpython <no-dsa> (Minor issue)
NOTE: https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-ffg3-p8fm-mjx2
NOTE: Fixed by: https://github.com/zopefoundation/RestrictedPython/commit/3737596ec9f28c34a073cc845bd2f4c0a80cb671 (8.3)
CVE-2026-55099 (icalendar is an RFC 5545 compatible parser and generator of iCalendar ...)
=====================================
data/dsa-needed.txt
=====================================
@@ -165,6 +165,8 @@ sabnzbdplus
--
shaarli
--
+social-auth-core
+--
sogo
Regression update for #1144734, new batch of issues from 5.12.10 release
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cf51689ec9b5231027c01e1e0970b3047f83876
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cf51689ec9b5231027c01e1e0970b3047f83876
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/1253494f/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list