[Git][security-tracker-team/security-tracker][master] 11 commits: lts: wabt postponed in bookworm
Utkarsh Gupta (@utkarsh)
utkarsh at debian.org
Sat Oct 3 23:21:15 BST 2026
Utkarsh Gupta pushed to branch master at Debian Security Tracker / security-tracker
Commits:
3155651c by Utkarsh Gupta at 2026-10-04T03:39:15+05:30
lts: wabt postponed in bookworm
- - - - -
bfd32a32 by Utkarsh Gupta at 2026-10-04T03:39:16+05:30
lts: weasyprint postponed in bookworm
- - - - -
3d185de7 by Utkarsh Gupta at 2026-10-04T03:39:18+05:30
lts: webpy postponed in bookworm
- - - - -
212d1e93 by Utkarsh Gupta at 2026-10-04T03:39:20+05:30
lts: wlc postponed in bookworm
- - - - -
5919f579 by Utkarsh Gupta at 2026-10-04T03:39:21+05:30
lts: xiphos postponed in bookworm
- - - - -
7624004a by Utkarsh Gupta at 2026-10-04T03:39:23+05:30
lts: yara postponed in bookworm
- - - - -
174766c4 by Utkarsh Gupta at 2026-10-04T03:39:25+05:30
lts: zaqar postponed in bookworm
- - - - -
5be33899 by Utkarsh Gupta at 2026-10-04T03:39:27+05:30
lts: zbar postponed in bookworm
- - - - -
48b83593 by Utkarsh Gupta at 2026-10-04T03:39:28+05:30
lts: znuny ignored in bookworm
- - - - -
385e3558 by Utkarsh Gupta at 2026-10-04T03:39:30+05:30
lts: golang-github-hashicorp-go-getter postponed in bookworm
- - - - -
e815005d by Utkarsh Gupta at 2026-10-04T03:39:32+05:30
lts: golang-oras-oras-go postponed in bookworm
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -11654,6 +11654,7 @@ CVE-2025-32000 (HCL Sametime is vulnerable to insufficient input sanitization. T
CVE-2026-97404 (In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Si ...)
- zaqar 23.0.0~rc1-3 (bug #1148897)
[trixie] - zaqar <no-dsa> (Minor issue)
+ [bookworm] - zaqar <postponed> (Minor issue)
NOTE: https://security.openstack.org/ossa/OSSA-2026-042.html
CVE-2026-88816 (DBI versions before 1.654 for Perl incorrectly treat numeric values as ...)
{DLA-4798-1}
@@ -14136,6 +14137,7 @@ CVE-2026-XXXX [GHSA-83g2-gf92-5c4g]
CVE-2026-95516
- zbar 0.23.93-10
[trixie] - zbar <no-dsa> (Minor issue)
+ [bookworm] - zbar <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2537756
CVE-2026-96273 (Ghidra before 12.1.4 fails to validate the TYPE_COL byte in OptionsDB. ...)
- ghidra <itp> (bug #923851)
@@ -14279,11 +14281,13 @@ CVE-2026-88344 (An out-of-bounds read vulnerability exists in the schema lexer o
CVE-2026-88341 (A reachable assertion vulnerability exists in YARA 4.5.8 when loading ...)
- yara <unfixed> (bug #1148825)
[trixie] - yara <no-dsa> (Minor issue)
+ [bookworm] - yara <postponed> (Minor issue)
NOTE: https://github.com/VirusTotal/yara/issues/2238
NOTE: Fixed by: https://github.com/NOUIY/yara/commit/0cdff36723cd260243bb2b330bda555693354760
CVE-2026-88340 (An invalid pointer release vulnerability exists in YARA 4.5.8 during d ...)
- yara <unfixed> (bug #1148825)
[trixie] - yara <no-dsa> (Minor issue)
+ [bookworm] - yara <postponed> (Minor issue)
NOTE: https://github.com/VirusTotal/yara/issues/2239
NOTE: https://github.com/VirusTotal/yara/pull/2244
CVE-2026-88339 (A NULL pointer dereference vulnerability exists in the gf_sg_vrml_fiel ...)
@@ -14419,6 +14423,7 @@ CVE-2026-62985 (request-filtering-agent is an http(s).Agent implementation that
CVE-2026-62364 (wlc is a Weblate command-line client using Weblate's REST API. Prior t ...)
- wlc <unfixed> (bug #1148878)
[trixie] - wlc <no-dsa> (Minor issue)
+ [bookworm] - wlc <postponed> (Minor issue)
NOTE: https://github.com/WeblateOrg/wlc/security/advisories/GHSA-3mqq-hv9c-85hc
NOTE: https://github.com/WeblateOrg/wlc/pull/1500
NOTE: Fixed by: https://github.com/WeblateOrg/wlc/commit/055fd2d43d0f72418b459286245330f08176db62 (2.0.1)
@@ -15255,14 +15260,17 @@ CVE-2026-79314 (A horizontal privilege escalation vulnerability exists in x-ui 0
CVE-2026-79313 (webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. Th ...)
- webpy <unfixed>
[trixie] - webpy <no-dsa> (Minor issue)
+ [bookworm] - webpy <postponed> (Minor issue)
NOTE: https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79313.md
CVE-2026-79312 (webpy web.py 0.76 is vulnerable to Session Fixation. The component Ses ...)
- webpy <unfixed>
[trixie] - webpy <no-dsa> (Minor issue)
+ [bookworm] - webpy <postponed> (Minor issue)
NOTE: https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79312.md
CVE-2026-79311 (webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via rend ...)
- webpy <unfixed>
[trixie] - webpy <no-dsa> (Minor issue)
+ [bookworm] - webpy <postponed> (Minor issue)
NOTE: https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79311.md
CVE-2026-77637 (Cloudreve is a self-hosted file management and sharing system. Prior t ...)
NOT-FOR-US: Cloudreve
@@ -15653,10 +15661,12 @@ CVE-2016-15059 (Net::IDN::Punycode versions before 2.301 for Perl allow a heap b
CVE-2026-XXXX [ZSA-2026-15]
- znuny 6.5.25-1
[trixie] - znuny <no-dsa> (Non-free not supported)
+ [bookworm] - znuny <ignored> (Non-free not supported)
NOTE: https://www.znuny.org/en/advisories/zsa-2026-15
CVE-2026-XXXX [ZSA-2026-14]
- znuny 6.5.25-1
[trixie] - znuny <no-dsa> (Non-free not supported)
+ [bookworm] - znuny <ignored> (Non-free not supported)
NOTE: https://www.znuny.org/en/advisories/zsa-2026-14
CVE-2026-94627 (vLLM Mooncake connector through 0.29.0 fails to properly manage GPU KV ...)
- vllm <itp> (bug #1095237)
@@ -15914,6 +15924,7 @@ CVE-2026-79316 (An improper access control vulnerability exists in x-ui 0.3.2. A
CVE-2026-79079 (An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execu ...)
- xiphos 4.4.0+dfsg1-1
[trixie] - xiphos <no-dsa> (Minor issue)
+ [bookworm] - xiphos <postponed> (Minor issue)
NOTE: https://github.com/crosswire/xiphos/pull/1314
NOTE: https://gist.github.com/lggcs/c1f98ce55ced44472651b9590d9f199a
NOTE: Fixed by: https://github.com/crosswire/xiphos/commit/f96ad3273277e7fb24908b40f3aa1e9efeeb4e85 (4.4.0)
@@ -22428,6 +22439,7 @@ CVE-2026-88975 (Http4s is a Scala interface for HTTP services. Prior to 0.23.37
NOT-FOR-US: Http4s
CVE-2026-88922 (The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to ...)
- golang-github-hashicorp-go-getter <removed>
+ [bookworm] - golang-github-hashicorp-go-getter <postponed> (Limited support, minor issue)
NOTE: https://discuss.hashicorp.com/t/hcsec-2026-39-go-getter-vulnerable-to-a-privilege-escalation-issue-in-its-archive-decompression-handling/77752
CVE-2026-88910 (The kboard WordPress plugin before 6.7 does not verify ownership or co ...)
NOT-FOR-US: WordPress plugin
@@ -22846,11 +22858,13 @@ CVE-2026-85756 (SSH.NET is a Secure Shell (SSH) library for .NET. Prior to 2026.
CVE-2026-85732 (oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, th ...)
- golang-oras-oras-go 2.6.2-1
[trixie] - golang-oras-oras-go <no-dsa> (Minor issue)
+ [bookworm] - golang-oras-oras-go <postponed> (Limited support, minor issue; v1.1.1 affected too, Tags() follows a cross-origin Link header)
NOTE: https://github.com/oras-project/oras-go/security/advisories/GHSA-h7vf-4x9w-h99v
NOTE: Fixed by: https://github.com/oras-project/oras-go/commit/31da1963f8c327dd089cd29faeae95cf0fc50842 (v2.6.2)
CVE-2026-85731 (oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, co ...)
- golang-oras-oras-go 2.6.2-1
[trixie] - golang-oras-oras-go <no-dsa> (Minor issue)
+ [bookworm] - golang-oras-oras-go <postponed> (Limited support, minor issue; v1.1.1 affected too, content/utils.go untar writes through symlink chains)
NOTE: https://github.com/oras-project/oras-go/security/advisories/GHSA-m37j-52j7-pjw7
NOTE: Fixed by: https://github.com/oras-project/oras-go/commit/adab2f25ea95ef4e6e41f50db9266a6701399422 (v2.6.2)
CVE-2026-85641 (The Formidable Forms WordPress plugin before 6.35 does not restrict w ...)
@@ -28850,6 +28864,7 @@ CVE-2026-55091 (flat-to-nested converts a hierarchy from a flat representation t
CVE-2026-55073 (WeasyPrint helps web developers to create PDF documents. Prior to 70.0 ...)
- weasyprint <unfixed> (bug #1148178)
[trixie] - weasyprint <no-dsa> (Minor issue)
+ [bookworm] - weasyprint <postponed> (Minor issue)
NOTE: https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-jf6q-chmf-3h3v
NOTE: https://github.com/Kozea/WeasyPrint/commit/289e278439b017cd9263b4cd4727026987f86443 (v70.0)
CVE-2026-55072 (Pimcore is an Open Source Data & Experience Management Platform. Prior ...)
@@ -29484,6 +29499,7 @@ CVE-2026-90651 (Socket Firewall (socketdev/socket-registry-firewall) in registry
CVE-2026-90648 (wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in som ...)
- wabt <unfixed>
[trixie] - wabt <no-dsa> (Minor issue)
+ [bookworm] - wabt <postponed> (Minor issue)
NOTE: https://github.com/trustsig-eu/wasm2c-tableflip
NOTE: https://bugzilla.mozilla.org/show_bug.cgi?id=1827704
NOTE: https://github.com/WebAssembly/wabt/issues/2831
@@ -133105,6 +133121,7 @@ CVE-2026-48189 (An improper Input Validation vulnerability in OTRS Customer Back
CVE-2026-48188 (An improper Input Validation vulnerability in OTRS or ((OTRS)) Communi ...)
- znuny 6.5.25-1
[trixie] - znuny <no-dsa> (Non-free not supported)
+ [bookworm] - znuny <ignored> (Non-free not supported)
NOTE: https://www.znuny.org/en/advisories/zsa-2026-13
CVE-2026-48187 (An uncontrolled allocation of resources without limits or throttling i ...)
NOT-FOR-US: OTRS
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/462f71dfee8101c262667cec77b94df43c7a638b...e815005d25587e97a318ae877cc9c628fb538fe3
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/462f71dfee8101c262667cec77b94df43c7a638b...e815005d25587e97a318ae877cc9c628fb538fe3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/d8b87ce8/attachment.htm>
More information about the debian-security-tracker-commits
mailing list