[Git][security-tracker-team/security-tracker][master] 7 commits: Correct issue reference and add fix commit for wabt

Sat Oct 3 23:57:40 BST 2026


Utkarsh Gupta pushed to branch master at Debian Security Tracker / security-tracker


Commits:
435aff93 by Utkarsh Gupta at 2026-10-03T23:47:21+05:30
Correct issue reference and add fix commit for wabt

- - - - -
e7d56ad8 by Utkarsh Gupta at 2026-10-03T23:56:09+05:30
Correct fix commit reference for golang-github-klauspost-compress

- - - - -
d96c243d by Utkarsh Gupta at 2026-10-03T23:59:44+05:30
Correct fix commit reference for libsoup3

- - - - -
50e024e9 by Utkarsh Gupta at 2026-10-04T00:01:59+05:30
Correct PR and fix commit reference for golang-github-rabbitmq-amqp091-go

- - - - -
f2f2d0c8 by Utkarsh Gupta at 2026-10-04T00:10:22+05:30
Add missing first fix commit reference for psd-tools

- - - - -
1833d6a5 by Utkarsh Gupta at 2026-10-04T00:17:13+05:30
Add missing parenthesis in golang-opentelemetry-otel NOTE

- - - - -
3d350b82 by Utkarsh Gupta at 2026-10-04T00:23:04+05:30
Correct introducing commit reference for rust-zip

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -4633,7 +4633,7 @@ CVE-2026-103399 (A flaw was found in SoupServer (libsoup). When an HTTP/1.x clie
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543949
 	NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/work_items/539
 	NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/560
-	NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/51216512b2afcd2fca0e2467a31a32d0c19d8b81
+	NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libsoup/-/commit/1b7fee598e0f644008028ca69d1ba74de8bc7db2 (3.8.0)
 CVE-2026-103398 (OpenSave through 2.4.0 fails to properly validate save paths supplied  ...)
 	NOT-FOR-US: OpenSave
 CVE-2026-103397 (OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN  ...)
@@ -5612,7 +5612,8 @@ CVE-2026-63209 (compress provides various compression algorithms. Prior to versi
 	[trixie] - golang-github-klauspost-compress <no-dsa> (Minor issue)
 	[bookworm] - golang-github-klauspost-compress <not-affected> (Vulnerable code introduced in 1.16.0)
 	NOTE: https://github.com/klauspost/compress/security/advisories/GHSA-259r-337f-4rfw
-	NOTE: Fixed by: https://github.com/klauspost/compress/commit/539243b8823ee8f03e49969823d57c348c917536 (v1.19.0)
+	NOTE: Fixed by: https://github.com/klauspost/compress/commit/bb2723d55de85353fd5a1817cbc382997a6a75aa (v1.19.0)
+	NOTE: Fixed by: https://github.com/klauspost/compress/commit/8668e357e776d5152ed62f33c17f21b8690664fa (v1.18.7)
 CVE-2026-4523 (GitLab has remediated an issue in GitLab CE/EE affecting all versions  ...)
 	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
 CVE-2026-4034 (Injection Vulnerability in Tibco Administrator version 5.13.0 & prior  ...)
@@ -14476,6 +14477,7 @@ CVE-2026-59991 (psd-tools is a Python package for working with Adobe Photoshop P
 	[trixie] - psd-tools <no-dsa> (Minor issue)
 	[bookworm] - psd-tools <postponed> (Minor issue)
 	NOTE: https://github.com/psd-tools/psd-tools/security/advisories/GHSA-8q6g-vjhf-jp8m
+	NOTE: Fixed by (merge): https://github.com/psd-tools/psd-tools/commit/132041a3d174901ecdfc257b366bdb9282e92f27 (v1.17.3)
 	NOTE: Fixed by: https://github.com/psd-tools/psd-tools/commit/a3d9a53ad51e667b5772a4f636ca6f2e16f4b271 (v1.17.4)
 CVE-2026-58268 (SIPGO is a library for writing SIP services in the GO language. Prior  ...)
 	NOT-FOR-US: sipgo
@@ -21936,7 +21938,7 @@ CVE-2026-81869 (OpenTelemetry-Go is the Go implementation of OpenTelemetry. From
 	NOTE: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-p9f8-wvj8-2fg8
 	NOTE: https://github.com/open-telemetry/opentelemetry-go/issues/5996
 	NOTE: https://github.com/open-telemetry/opentelemetry-go/pull/5997
-	NOTE: Introduced with: https://github.com/open-telemetry/opentelemetry-go/commit/49a653682f1257a66771324e818f6a83fb13d62b (v1.10.0
+	NOTE: Introduced with: https://github.com/open-telemetry/opentelemetry-go/commit/49a653682f1257a66771324e818f6a83fb13d62b (v1.10.0)
 	NOTE: Fixed by: https://github.com/open-telemetry/opentelemetry-go/commit/e016a78c9f5b24a1c2beeaad47686c2f2213f49a (v1.33.0)
 CVE-2026-81866 (Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration updat ...)
 	NOT-FOR-US: Apache software not packaged in Debian
@@ -29560,7 +29562,8 @@ CVE-2026-90648 (wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape
 	[bookworm] - wabt <postponed> (Minor issue)
 	NOTE: https://github.com/trustsig-eu/wasm2c-tableflip
 	NOTE: https://bugzilla.mozilla.org/show_bug.cgi?id=1827704
-	NOTE: https://github.com/WebAssembly/wabt/issues/2831
+	NOTE: https://github.com/WebAssembly/wabt/issues/2854
+	NOTE: Fixed by: https://github.com/WebAssembly/wabt/commit/e197d0b7bd3fe426f5963ae540f4426a1d49e89f
 CVE-2026-90647 (ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on W ...)
 	NOT-FOR-US: ASE/Kalkitech ASE2000 V2 Communication Test Set
 CVE-2026-90499 (A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This af ...)
@@ -48740,8 +48743,8 @@ CVE-2026-79921 (amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a c
 	[trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
 	[bookworm] - golang-github-rabbitmq-amqp091-go <postponed> (Limited support)
 	NOTE: https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp
-	NOTE: https://github.com/rabbitmq/amqp091-go/pull/353
-	NOTE: Fixed by (merge): https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0 (v1.13.0)
+	NOTE: https://github.com/rabbitmq/amqp091-go/pull/369
+	NOTE: Fixed by: https://github.com/rabbitmq/amqp091-go/commit/08f7f63c73cfd2827be03e769ae96599b91dcc02 (v1.13.0)
 CVE-2026-78333 (The 12 Step Meeting List WordPress plugin before 3.19.17 does not sani ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-78139 (The Notifima  WordPress plugin before 3.1.4 does not verify that the c ...)
@@ -313853,7 +313856,7 @@ CVE-2025-29787 (`zip` is a zip library for rust which supports reading and writi
 	- rust-zip <not-affected> (Vulnerable code never in Debian released revision)
 	NOTE: https://rustsec.org/advisories/RUSTSEC-2025-0168.html
 	NOTE: https://github.com/zip-rs/zip2/security/advisories/GHSA-94vh-gphv-8pm8
-	NOTE: Introduced with: https://github.com/zip-rs/zip2/commit/633a6733e6ebb19de9745d6679935c2b168821d0 (v1.3.)
+	NOTE: Introduced with: https://github.com/zip-rs/zip2/commit/8715d936cbd3e0fdc2e778b70d8a02e2dfc16fc2 (v1.3.0)
 	NOTE: Fixed by: https://github.com/zip-rs/zip2/commit/a2e062f37066c3b12860a32eb1cb44856cfb7afe (v2.3.0)
 CVE-2025-29786 (Expr is an expression language and expression evaluation for Go. Prior ...)
 	- golang-github-antonmedv-expr <unfixed> (bug #1103788)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/1c8d620c5e6d9516f8606f8d636da4de9777ad22...3d350b827c9312a4f1079390f9dcbbe661252c5a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/1c8d620c5e6d9516f8606f8d636da4de9777ad22...3d350b827c9312a4f1079390f9dcbbe661252c5a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261003/4bdbf17e/attachment.htm>
