[Git][security-tracker-team/security-tracker][master] 12 commits: lts: node-got postponed in bookworm
Utkarsh Gupta (@utkarsh)
utkarsh at debian.org
Sat Oct 3 23:18:08 BST 2026
Utkarsh Gupta pushed to branch master at Debian Security Tracker / security-tracker
Commits:
a5b3adbc by Utkarsh Gupta at 2026-10-04T03:38:27+05:30
lts: node-got postponed in bookworm
- - - - -
54d9ed76 by Utkarsh Gupta at 2026-10-04T03:38:29+05:30
lts: node-pbkdf2 postponed in bookworm
- - - - -
60b64267 by Utkarsh Gupta at 2026-10-04T03:38:31+05:30
lts: node-postcss postponed in bookworm
- - - - -
153ff743 by Utkarsh Gupta at 2026-10-04T03:38:32+05:30
lts: node-uri-js postponed in bookworm
- - - - -
79d4dff3 by Utkarsh Gupta at 2026-10-04T03:38:34+05:30
lts: nvidia-graphics-drivers-tesla-535 ignored in bookworm
- - - - -
147c9552 by Utkarsh Gupta at 2026-10-04T03:38:36+05:30
lts: osmo-bsc postponed in bookworm
- - - - -
e0055e1f by Utkarsh Gupta at 2026-10-04T03:38:38+05:30
lts: osmo-iuh postponed in bookworm
- - - - -
9f00cd7e by Utkarsh Gupta at 2026-10-04T03:38:39+05:30
lts: php-getid3 postponed in bookworm
- - - - -
e163d62d by Utkarsh Gupta at 2026-10-04T03:38:41+05:30
lts: poppler postponed in bookworm
- - - - -
dbe7c817 by Utkarsh Gupta at 2026-10-04T03:38:43+05:30
lts: psd-tools postponed in bookworm
- - - - -
dd2a489f by Utkarsh Gupta at 2026-10-04T03:38:44+05:30
lts: pymongo postponed in bookworm
- - - - -
07118875 by Utkarsh Gupta at 2026-10-04T03:38:46+05:30
lts: pypy3 postponed in bookworm
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2845,6 +2845,7 @@ CVE-2026-47604 (NVIDIA GPU Display Driver for Windows and Linux contains a vulne
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
+ [bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
- nvidia-graphics-drivers-tesla-550 <unfixed>
NOTE: https://nvidia.custhelp.com/app/answers/detail/a_id/5861
CVE-2026-47603 (NVIDIA GPU Display Driver for Windows and Linux contains a vulnerabili ...)
@@ -2865,6 +2866,7 @@ CVE-2026-47603 (NVIDIA GPU Display Driver for Windows and Linux contains a vulne
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
+ [bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
- nvidia-graphics-drivers-tesla-550 <unfixed>
NOTE: https://nvidia.custhelp.com/app/answers/detail/a_id/5861
CVE-2026-47602 (NVIDIA GPU Display Driver for Windows and Linux contains a vulnerabili ...)
@@ -2885,6 +2887,7 @@ CVE-2026-47602 (NVIDIA GPU Display Driver for Windows and Linux contains a vulne
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
+ [bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
- nvidia-graphics-drivers-tesla-550 <unfixed>
NOTE: https://nvidia.custhelp.com/app/answers/detail/a_id/5861
CVE-2026-47601 (NVIDIA GPU Display Driver for Windows and Linux contains a vulnerabili ...)
@@ -2905,6 +2908,7 @@ CVE-2026-47601 (NVIDIA GPU Display Driver for Windows and Linux contains a vulne
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
+ [bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
- nvidia-graphics-drivers-tesla-550 <unfixed>
NOTE: https://nvidia.custhelp.com/app/answers/detail/a_id/5861
CVE-2026-47600 (NVIDIA GPU Display Driver for Windows and Linux contains a vulnerabili ...)
@@ -2925,6 +2929,7 @@ CVE-2026-47600 (NVIDIA GPU Display Driver for Windows and Linux contains a vulne
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
+ [bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
- nvidia-graphics-drivers-tesla-550 <unfixed>
NOTE: https://nvidia.custhelp.com/app/answers/detail/a_id/5861
CVE-2026-47599 (NVIDIA GPU Display Driver for Linux contains a vulnerability in the op ...)
@@ -2945,6 +2950,7 @@ CVE-2026-47599 (NVIDIA GPU Display Driver for Linux contains a vulnerability in
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
+ [bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
- nvidia-graphics-drivers-tesla-550 <unfixed>
NOTE: https://nvidia.custhelp.com/app/answers/detail/a_id/5861
CVE-2026-47598 (NVIDIA GPU Display Driver for Linux contains a vulnerability in the op ...)
@@ -2965,6 +2971,7 @@ CVE-2026-47598 (NVIDIA GPU Display Driver for Linux contains a vulnerability in
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
+ [bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
- nvidia-graphics-drivers-tesla-550 <unfixed>
NOTE: https://nvidia.custhelp.com/app/answers/detail/a_id/5861
CVE-2026-47597 (NVIDIA GPU Display Driver for Windows and Linux contains a vulnerabili ...)
@@ -2985,6 +2992,7 @@ CVE-2026-47597 (NVIDIA GPU Display Driver for Windows and Linux contains a vulne
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
+ [bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
- nvidia-graphics-drivers-tesla-550 <unfixed>
NOTE: https://nvidia.custhelp.com/app/answers/detail/a_id/5861
CVE-2026-47596 (NVIDIA GPU Display Driver for Linux contains a vulnerability in the ke ...)
@@ -3005,6 +3013,7 @@ CVE-2026-47596 (NVIDIA GPU Display Driver for Linux contains a vulnerability in
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
+ [bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
- nvidia-graphics-drivers-tesla-550 <unfixed>
NOTE: https://nvidia.custhelp.com/app/answers/detail/a_id/5861
CVE-2026-47595 (NVIDIA GPU Display Driver for Linux contains a vulnerability in the ke ...)
@@ -3025,6 +3034,7 @@ CVE-2026-47595 (NVIDIA GPU Display Driver for Linux contains a vulnerability in
[trixie] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
- nvidia-graphics-drivers-tesla-535 <unfixed>
[trixie] - nvidia-graphics-drivers-tesla-535 <no-dsa> (Non-free not supported)
+ [bookworm] - nvidia-graphics-drivers-tesla-535 <ignored> (Non-free not supported)
- nvidia-graphics-drivers-tesla-550 <unfixed>
NOTE: https://nvidia.custhelp.com/app/answers/detail/a_id/5861
CVE-2026-47594 (NVIDIA GPU Display Driver for Windows and Linux contains a vulnerabili ...)
@@ -4529,6 +4539,7 @@ CVE-2026-19553 (ssl.SSLContext.wrap_bio() didn't require the server_hostname arg
- python3.11 <removed>
- pypy3 <unfixed>
[trixie] - pypy3 <no-dsa> (Minor issue)
+ [bookworm] - pypy3 <postponed> (Minor issue)
NOTE: https://github.com/python/cpython/issues/156793
NOTE: https://github.com/python/cpython/pull/158503
NOTE: https://github.com/python/cpython/commit/641390146a16a38e6701923f4ee4f1940ae77082 (v3.15.0rc3)
@@ -4838,6 +4849,7 @@ CVE-2026-19445 (A remote, unauthenticated TLS client can make a server crash or
- python3.11 <removed>
- pypy3 <unfixed>
[trixie] - pypy3 <no-dsa> (Minor issue)
+ [bookworm] - pypy3 <postponed> (Minor issue)
NOTE: https://github.com/python/cpython/issues/156293
NOTE: https://github.com/python/cpython/pull/158504
NOTE: https://github.com/python/cpython/commit/63fab143d94cafae71850831acfb52041ba44af7 (v3.15.0rc3)
@@ -5548,6 +5560,7 @@ CVE-2026-77177 (Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI
CVE-2026-76875 (PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vul ...)
- pypy3 8.0.0+dfsg-1
[trixie] - pypy3 <no-dsa> (Minor issue)
+ [bookworm] - pypy3 <postponed> (Minor issue)
CVE-2026-76720 (A vulnerability in HPE OneView can be remotely exploited to cause a UR ...)
NOT-FOR-US: HPE
CVE-2026-76719 (A security vulnerability in HPE OneView may be exploited remotely to p ...)
@@ -5616,6 +5629,7 @@ CVE-2026-12345 (The cleanup of tempfile.TemporaryDirectory is vulnerable to a ra
- python3.11 <removed>
- pypy3 <unfixed>
[trixie] - pypy3 <no-dsa> (Minor issue)
+ [bookworm] - pypy3 <postponed> (Minor issue)
NOTE: https://github.com/python/cpython/issues/157579
NOTE: https://github.com/python/cpython/pull/157580
CVE-2026-11796 (Asset Suite allows unauthenticated users to access PropertiesReloadSer ...)
@@ -6662,6 +6676,7 @@ CVE-2026-102422 (shell-quote's `quote()` function emits a `{ comment }` token as
CVE-2026-102414 (pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's bloc ...)
- node-pbkdf2 3.1.7+~3.1.2-1 (bug #1149792)
[trixie] - node-pbkdf2 <no-dsa> (Minor issue)
+ [bookworm] - node-pbkdf2 <postponed> (Minor issue)
NOTE: https://github.com/browserify/pbkdf2/security/advisories/GHSA-477h-4r7f-fvrx
NOTE: https://github.com/browserify/pbkdf2/issues/82
NOTE: Fixed by: https://github.com/browserify/pbkdf2/commit/493d8d8ff437f680338bf7397398fda884ad462e (v3.1.7)
@@ -11121,14 +11136,17 @@ CVE-2026-96750 (MongoDB Compass can interpolate a database name without escaping
CVE-2026-96749 (An integer overflow in the BSON document encoding component of the Mon ...)
- pymongo <unfixed> (bug #1148967)
[trixie] - pymongo <no-dsa> (Minor issue)
+ [bookworm] - pymongo <postponed> (Minor issue)
NOTE: https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-v4x9-3549-crwv
CVE-2026-96748 (PyMongo's connection string parsing decodes percent-encoded characters ...)
- pymongo <unfixed> (bug #1148967)
[trixie] - pymongo <no-dsa> (Minor issue)
+ [bookworm] - pymongo <postponed> (Minor issue)
NOTE: https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-vp6j-j7w5-5xjj
CVE-2026-96747 (The client-side field level encryption support in the MongoDB Python D ...)
- pymongo <unfixed> (bug #1148967)
[trixie] - pymongo <no-dsa> (Minor issue)
+ [bookworm] - pymongo <postponed> (Minor issue)
NOTE: https://github.com/mongodb/mongo-python-driver/security/advisories/GHSA-qx36-8mw2-4r3x
CVE-2026-96746 (An out-of-bounds write in the connection-monitoring logic of the Mongo ...)
- mongo-c-driver 2.5.5-1
@@ -14401,6 +14419,7 @@ CVE-2026-5924 (The Getwid \u2013 Gutenberg Blocks plugin for WordPress is vulner
CVE-2026-59991 (psd-tools is a Python package for working with Adobe Photoshop PSD fil ...)
- psd-tools 1.17.4+dfsg.1-1
[trixie] - psd-tools <no-dsa> (Minor issue)
+ [bookworm] - psd-tools <postponed> (Minor issue)
NOTE: https://github.com/psd-tools/psd-tools/security/advisories/GHSA-8q6g-vjhf-jp8m
NOTE: Fixed by: https://github.com/psd-tools/psd-tools/commit/a3d9a53ad51e667b5772a4f636ca6f2e16f4b271 (v1.17.4)
CVE-2026-58268 (SIPGO is a library for writing SIP services in the GO language. Prior ...)
@@ -16339,6 +16358,7 @@ CVE-2026-94107 (NivoCart through 2.4.0 contains a predictable password reset tok
CVE-2026-94106 (getID3 before 1.9.26 contains an OS command injection vulnerability in ...)
- php-getid3 1.9.26+dfsg-1 (bug #1148666)
[trixie] - php-getid3 <no-dsa> (Minor issue)
+ [bookworm] - php-getid3 <postponed> (Minor issue)
NOTE: https://github.com/JamesHeinrich/getID3/security/advisories/GHSA-qf3m-pmjh-h6fx
NOTE: https://github.com/JamesHeinrich/getID3/issues/503
NOTE: https://github.com/JamesHeinrich/getID3/commit/ce598c4f3823441d878c5a7a2a9f2f703a3e10b6 (v1.9.26)
@@ -17094,20 +17114,24 @@ CVE-2026-93752 (CSSOM through 0.5.0 contains a denial of service vulnerability i
CVE-2026-93751 (uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability ...)
- node-uri-js <unfixed> (bug #1148403)
[trixie] - node-uri-js <no-dsa> (Minor issue)
+ [bookworm] - node-uri-js <postponed> (Minor issue)
NOTE: https://github.com/garycourt/uri-js/issues/106
CVE-2026-93750 (http-cache-semantics through 4.2.0 contains a cache validation vulnera ...)
- node-got <unfixed> (bug #1148406)
[trixie] - node-got <no-dsa> (Minor issue)
+ [bookworm] - node-got <postponed> (Minor issue)
NOTE: https://github.com/kornelski/http-cache-semantics/issues/57
NOTE: node-got embeds and provides node-http-cache-semantics
CVE-2026-93749 (source-map-js through 1.2.1 fails to validate the per-section offset l ...)
- node-postcss <unfixed> (bug #1148404)
[trixie] - node-postcss <no-dsa> (Minor issue)
+ [bookworm] - node-postcss <postponed> (Minor issue)
NOTE: https://github.com/7rulnik/source-map-js/issues/76
NOTE: node-postcss embeds and provides node-source-map-js
CVE-2026-93748 (http-cache-semantics through 4.2.0 fails to properly validate security ...)
- node-got <unfixed> (bug #1148405)
[trixie] - node-got <no-dsa> (Minor issue)
+ [bookworm] - node-got <postponed> (Minor issue)
NOTE: https://github.com/kornelski/http-cache-semantics/issues/56
NOTE: node-got embeds and provides node-http-cache-semantics
CVE-2026-93737 (Azkaban through 4.0.0 omits project permission checks in the ScheduleS ...)
@@ -17117,6 +17141,7 @@ CVE-2026-93736 (Mealie before 3.21.0 fails to validate user ownership in the rat
CVE-2026-93690 (uri-js through 4.4.1 contains a denial of service vulnerability in the ...)
- node-uri-js <unfixed> (bug #1148402)
[trixie] - node-uri-js <no-dsa> (Minor issue)
+ [bookworm] - node-uri-js <postponed> (Minor issue)
NOTE: https://github.com/garycourt/uri-js/issues/105
CVE-2026-93689 (WinFsp through 2.2.26215 contains a null pointer dereference vulnerabi ...)
NOT-FOR-US: WinFsp
@@ -17147,6 +17172,7 @@ CVE-2026-93657 (hickory-resolver versions before 0.26.2 fail to propagate bogus
CVE-2026-93653 (A denial of service flaw was found in Poppler's Splash backend. A craf ...)
- poppler <unfixed> (bug #1148398)
[trixie] - poppler <no-dsa> (Minor issue)
+ [bookworm] - poppler <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2537005
CVE-2026-93652 (Integer overflow in \xb5D3TN v0.15.0 TCPCLv3 handshake causes heap ove ...)
NOT-FOR-US: ud3tn
@@ -17546,10 +17572,12 @@ CVE-2026-75894 (In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was f
[experimental] - osmo-iuh 1.8.1+dfsg1-1
- osmo-iuh <unfixed> (bug #1148471)
[trixie] - osmo-iuh <no-dsa> (Minor issue)
+ [bookworm] - osmo-iuh <postponed> (Minor issue)
NOTE: https://cgit.osmocom.org/osmo-iuh/commit/?id=f06967126f486bcb185ccf3d1a8f9bc02c4da1f6 (1.8.1)
CVE-2026-75893 (In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow iss ...)
- osmo-bsc <unfixed> (bug #1148556)
[trixie] - osmo-bsc <no-dsa> (Minor issue)
+ [bookworm] - osmo-bsc <postponed> (Minor issue)
NOTE: Fixed by: https://cgit.osmocom.org/osmo-bsc/commit/?id=2852a03c153cd9418c2a86d0b2193ac41169dbb7 (1.15.0)
CVE-2026-75892 (In osmo-ggsn 1.14.0 an out of bounds write issue was found in thegtp_d ...)
- osmo-ggsn <not-affected> (Vulnerable code introduced later)
@@ -18009,24 +18037,28 @@ CVE-2026-93331 (A vulnerability was identified in GPAC 26.08-DEV. This vulnerabi
CVE-2026-93314 (A vulnerability was determined in Freedesktop Poppler 26.07.0. This af ...)
- poppler <unfixed> (bug #1148266)
[trixie] - poppler <no-dsa> (Minor issue)
+ [bookworm] - poppler <postponed> (Minor issue)
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1761
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2315
NOTE: Fixed by: https://gitlab.freedesktop.org/poppler/poppler/-/commit/ed2a5538cf0a8d3ff908191eda9b73f91a5f952a (poppler-26.08.0)
CVE-2026-93313 (A vulnerability was found in Freedesktop Poppler 26.07.0. The impacted ...)
- poppler <unfixed> (bug #1148266)
[trixie] - poppler <no-dsa> (Minor issue)
+ [bookworm] - poppler <postponed> (Minor issue)
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1760
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2322
NOTE: Fixed by: https://gitlab.freedesktop.org/poppler/poppler/-/commit/eb87cf711563894649bd0c365baa479401dc6d51
CVE-2026-93312 (A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the ...)
- poppler <unfixed> (bug #1148266)
[trixie] - poppler <no-dsa> (Minor issue)
+ [bookworm] - poppler <postponed> (Minor issue)
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1759
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2314
NOTE: Fixed by: https://gitlab.freedesktop.org/poppler/poppler/-/commit/5e49250f13b0390edeb3f90eb4c02c9941f97067 (poppler-26.08.0)
CVE-2026-93311 (A vulnerability was detected in Freedesktop Poppler 26.07.0. This issu ...)
- poppler <unfixed> (bug #1148267)
[trixie] - poppler <no-dsa> (Minor issue)
+ [bookworm] - poppler <postponed> (Minor issue)
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1758
CVE-2026-93310 (A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This af ...)
NOT-FOR-US: O-RAN-SC SMO OAM
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/885baaecdd0b83f75769c8f3976f6d3ec7e6fc94...071188754c10adda11cfb6aca472ed21545fba3d
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/885baaecdd0b83f75769c8f3976f6d3ec7e6fc94...071188754c10adda11cfb6aca472ed21545fba3d
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/3795f95b/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list