[Git][security-tracker-team/security-tracker][master] CVE-2026-85091/zlib - remove annotation that bookworm is not affected.

[Tobias Frost (@tobi)]

Tobias Frost pushed to branch master at Debian Security Tracker / security-tracker


Commits:
cb30d369 by Tobias Frost at 2026-10-04T09:56:02+02:00
CVE-2026-85091/zlib - remove annotation that bookworm is not affected.

it is not affected for the non-blocking path, but other I/O erors, when the user clears the error manually with gzclearerror(), seems to be able to trigger the same state corruption. Therefore removing the annotation until further analysis.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -41468,7 +41468,6 @@ CVE-2026-85092 (LiME through 1.12.0 fails to validate the disk acquisition outpu
 	NOT-FOR-US: LiME
 CVE-2026-85091 (zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...)
 	- zlib <unfixed> (bug #1146895)
-	[bookworm] - zlib <not-affected> (vulnerable code introduced later)
 	NOTE: https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490
 	NOTE: https://github.com/madler/zlib/issues/1310
 	NOTE: https://github.com/madler/zlib/pull/1317



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cb30d369bb301a272869ea945f3269645a43f8ad

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cb30d369bb301a272869ea945f3269645a43f8ad
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261004/708edd08/attachment.htm>