[Git][security-tracker-team/security-tracker][master] 2 commits: Add some thrift references to upstream JIRA issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Oct 3 21:37:07 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
8e79f1fb by Santiago Ruano Rincón at 2026-10-02T20:20:27-03:00
Add some thrift references to upstream JIRA issues
- - - - -
42f1eb54 by Salvatore Bonaccorso at 2026-10-03T22:36:59+02:00
Merge branch 'thrift-2026-10' into 'master'
Add some thrift references to upstream JIRA issues
See merge request security-tracker-team/security-tracker!331
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -86369,6 +86369,7 @@ CVE-2026-58662 (Improper Validation of Specified Quantity in Input, Out-of-bound
[trixie] - thrift <no-dsa> (Minor issue)
[bookworm] - thrift <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread/13mzvylr3r3nktxrh5k1h30ng1t1sw1d
+ NOTE: https://issues.apache.org/jira/browse/THRIFT-6096
CVE-2026-58389 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
[experimental] - thrift 0.24.0-1
- thrift 0.24.0-2 (unimportant)
@@ -86389,6 +86390,7 @@ CVE-2026-58023 (Out-of-bounds Read vulnerability in Apache Thrift c_glib binding
[trixie] - thrift <no-dsa> (Minor issue)
[bookworm] - thrift <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread/z2myopbovxngfvchdz8hddots9p5ffbt
+ NOTE: https://issues.apache.org/jira/browse/THRIFT-6094
CVE-2026-57917 (proCertum SmartSignparses external XML entities from arbitrary crafted ...)
NOT-FOR-US: proCertum SmartSign
CVE-2026-57916 (proCertum SmartSign opens Certificate Practice Statement (CPS) URI wit ...)
@@ -86403,18 +86405,21 @@ CVE-2026-55971 (Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bi
[trixie] - thrift <no-dsa> (Minor issue)
[bookworm] - thrift <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread/xjs36m6kjxpmrmzwck636msg3nvoqnmx
+ NOTE: https://issues.apache.org/jira/browse/THRIFT-6093
CVE-2026-55970 (Buffer Over-read vulnerability in Apache Thrift C++ bindings. This is ...)
[experimental] - thrift 0.24.0-1
- thrift 0.24.0-2
[trixie] - thrift <no-dsa> (Minor issue)
[bookworm] - thrift <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread/8pbnw4dyxxc9opp6qq725jhrzg25v8q7
+ NOTE: https://issues.apache.org/jira/browse/THRIFT-6092
CVE-2026-55969 (Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_g ...)
[experimental] - thrift 0.24.0-1
- thrift 0.24.0-2
[trixie] - thrift <no-dsa> (Minor issue)
[bookworm] - thrift <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread/xmkgd107k795hyrg5kf97mny30sgl5bo
+ NOTE: https://issues.apache.org/jira/browse/THRIFT-6091
CVE-2026-55968 (Inefficient Algorithmic Complexity, Allocation of Resources Without Li ...)
[experimental] - thrift 0.24.0-1
- thrift 0.24.0-2 (unimportant)
@@ -86489,18 +86494,21 @@ CVE-2026-48586 (Improper Handling of Highly Compressed Data (Data Amplification)
[trixie] - thrift <no-dsa> (Minor issue)
[bookworm] - thrift <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq
+ NOTE: https://issues.apache.org/jira/browse/THRIFT-6088
CVE-2026-48145 (Improper Validation of Certificate with Host Mismatch vulnerability in ...)
[experimental] - thrift 0.24.0-1
- thrift 0.24.0-2
[trixie] - thrift <no-dsa> (Minor issue)
[bookworm] - thrift <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread/2popgc4ks1l87jjho1w5fpk5k4x06b7h
+ NOTE: https://issues.apache.org/jira/browse/THRIFT-6087
CVE-2026-48144 (Improper Validation of Certificate with Host Mismatch vulnerability in ...)
[experimental] - thrift 0.24.0-1
- thrift 0.24.0-2
[trixie] - thrift <no-dsa> (Minor issue)
[bookworm] - thrift <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread/2xoltfxgzf5jyhcwq6y07spts5cn6ppj
+ NOTE: https://issues.apache.org/jira/browse/THRIFT-6086
CVE-2026-48052 (Papra is a minimalistic document management and archiving platform. Pr ...)
NOT-FOR-US: Papra
CVE-2026-48051 (Papra is a minimalistic document management and archiving platform. Pr ...)
@@ -86530,12 +86538,14 @@ CVE-2026-45112 (Allocation of Resources Without Limits or Throttling vulnerabili
[trixie] - thrift <no-dsa> (Minor issue)
[bookworm] - thrift <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread/hl9kmf1z2o3lxvspoj3g9ykl8lj9mdxc
+ NOTE: https://issues.apache.org/jira/browse/THRIFT-6085
CVE-2026-43871 (Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability i ...)
[experimental] - thrift 0.24.0-1
- thrift 0.24.0-2
[trixie] - thrift <no-dsa> (Minor issue)
[bookworm] - thrift <postponed> (Minor issue)
NOTE: https://lists.apache.org/thread/l4dwf14zbyqsmkc28c99ojj3t3gg9qby
+ NOTE: https://issues.apache.org/jira/browse/THRIFT-6084
CVE-2026-42792 (Improper Handling of Exceptional Conditions vulnerability in Erlang OT ...)
{DSA-6464-1}
- erlang 1:29.0.4+dfsg-1 (bug #1142985)
@@ -86549,6 +86559,7 @@ CVE-2026-41608 (Improper Handling of Highly Compressed Data (Data Amplification)
[trixie] - thrift <no-dsa> (Minor issue)
[bookworm] - thrift <postponed> (Minor issue, DoS)
NOTE: https://lists.apache.org/thread/vwsbcwqdpwdtp8qkjo11ol6rodbfm21f
+ NOTE: https://issues.apache.org/jira/browse/THRIFT-6083
CVE-2026-40000 (The Activity zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity wit ...)
NOT-FOR-US: ZTE
CVE-2026-24252 (NVIDIA NeMo for Linux contains a vulnerability where an attacker may c ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/49a134a65a481c6f2f00666b857aea1b3cc71cfe...42f1eb54cc31d5cbadaab19e2c7afb52db695ac7
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/49a134a65a481c6f2f00666b857aea1b3cc71cfe...42f1eb54cc31d5cbadaab19e2c7afb52db695ac7
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/4db93822/attachment.htm>
More information about the debian-security-tracker-commits
mailing list