[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
fa4cbb93 by Salvatore Bonaccorso at 2026-10-02T17:03:51+02:00
Add Debian bug references for various issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -630,15 +630,15 @@ CVE-2026-103687 (A vulnerability has been found in rhukster dom-sanitizer up to
 CVE-2026-103686 (A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted ...)
 	NOT-FOR-US: DOMSanitizer
 CVE-2026-103680 (A flaw was found in tnef. A heap-based buffer overflow can occur in th ...)
-	- tnef <unfixed> (unimportant)
+	- tnef <unfixed> (unimportant; bug #1149710)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2544478
 	NOTE: Crash in CLI tool, no security impact (mitigated by toolchain hardening)
 CVE-2026-103679 (A flaw was found in tnef. A remote attacker could exploit this vulnera ...)
-	- tnef <unfixed> (unimportant)
+	- tnef <unfixed> (unimportant; bug #1149710)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2544477
 	NOTE: Crash in CLI tool, no security impact
 CVE-2026-103678 (A flaw was found in tnef. An attacker can exploit this vulnerability b ...)
-	- tnef <unfixed> (unimportant)
+	- tnef <unfixed> (unimportant; bug #1149710)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2544476
 	NOTE: Crash in CLI tool, no security impact
 CVE-2026-103664 (MISP contains a reflected cross-site scripting (XSS) vulnerability in  ...)
@@ -676,7 +676,7 @@ CVE-2026-103489 (In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS
 CVE-2026-103488 (In JetBrains YouTrack before 2026.2.19422 missing authorisation allowe ...)
 	NOT-FOR-US: JetBrains
 CVE-2026-103431 (colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 termin ...)
-	- collectl <unfixed>
+	- collectl <unfixed> (bug #1149711)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543974
 CVE-2026-103353 (Incorrect Behavior Order vulnerability in WP ManageNinja LLC FluentFor ...)
 	NOT-FOR-US: WordPress plugin or theme
@@ -753,15 +753,15 @@ CVE-2026-103265 (Fleet versions before 4.89.0 fail to properly filter MDM comman
 CVE-2026-103264 (Fleet versions before 4.87.0 contain an authentication bypass vulnerab ...)
 	NOT-FOR-US: Fleet
 CVE-2026-103263 (Tornado before 6.5.9 contains a path traversal vulnerability in Static ...)
-	- python-tornado <unfixed>
+	- python-tornado <unfixed> (bug #1149712)
 	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
 	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32 (v6.5.9)
 CVE-2026-103262 (Tornado versions before 6.5.9 contain an unbounded memory accumulation ...)
-	- python-tornado <unfixed>
+	- python-tornado <unfixed> (bug #1149712)
 	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
 	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9 (v6.5.9)
 CVE-2026-103261 (Tornado before 6.5.9 fails to limit the number of query string fields  ...)
-	- python-tornado <unfixed>
+	- python-tornado <unfixed> (bug #1149712)
 	NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65
 	NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93 (v6.5.9)
 CVE-2026-103260 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approva ...)
@@ -5506,7 +5506,7 @@ CVE-2026-18413 (The ADC API requires each driver to reject a sampling sequence w
 CVE-2026-16513 (The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys ...)
 	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-102422 (shell-quote's `quote()` function emits a `{ comment }` token as `#` fo ...)
-	- node-shell-quote <unfixed>
+	- node-shell-quote <unfixed> (bug #1149713)
 	NOTE: https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv
 	NOTE: Fixed by: https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc (v1.11.0)
 CVE-2026-102414 (pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's bloc ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fa4cbb9334a73b2e4fa7977a5b0c182cba7ae206

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fa4cbb9334a73b2e4fa7977a5b0c182cba7ae206
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261002/c229961f/attachment-0001.htm>