[Git][security-tracker-team/security-tracker][master] 18 commits: lts: python-urllib3 postponed in bookworm
Utkarsh Gupta (@utkarsh)
utkarsh at debian.org
Sun Oct 4 14:32:49 BST 2026
Utkarsh Gupta pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ad74d1f4 by Utkarsh Gupta at 2026-10-04T05:47:32+05:30
lts: python-urllib3 postponed in bookworm
- - - - -
fbec7f9e by Utkarsh Gupta at 2026-10-04T05:54:43+05:30
lts: triage ppp in bookworm
- - - - -
43d19b0f by Utkarsh Gupta at 2026-10-04T06:00:30+05:30
lts: rpm postponed in bookworm
- - - - -
eed7bbfc by Utkarsh Gupta at 2026-10-04T06:20:03+05:30
lts: rpcbind postponed in bookworm
- - - - -
07925e91 by Utkarsh Gupta at 2026-10-04T06:29:49+05:30
lts: multipath-tools postponed in bookworm
- - - - -
612870ba by Utkarsh Gupta at 2026-10-04T06:55:21+05:30
lts: ruby-json not-affected in bookworm
- - - - -
ea505171 by Utkarsh Gupta at 2026-10-04T06:58:07+05:30
lts: poppler postponed in bookworm
- - - - -
c0d65df1 by Utkarsh Gupta at 2026-10-04T07:00:46+05:30
dla-needed: add wpa
- - - - -
e755e8c8 by Utkarsh Gupta at 2026-10-04T07:07:47+05:30
lts: libde265 issues already fixed in bookworm
- - - - -
22212d32 by Utkarsh Gupta at 2026-10-04T08:01:32+05:30
lts: freetype postponed in bookworm
- - - - -
3f5435f0 by Utkarsh Gupta at 2026-10-04T08:03:54+05:30
lts: openssh not-affected in bookworm
- - - - -
f62b7c8f by Utkarsh Gupta at 2026-10-04T08:09:10+05:30
lts: triage pyjwt in bookworm
- - - - -
5e4282c5 by Utkarsh Gupta at 2026-10-04T08:11:57+05:30
lts: dash postponed in bookworm
- - - - -
f689415d by Utkarsh Gupta at 2026-10-04T08:22:50+05:30
lts: triage python-virtualenv in bookworm
- - - - -
585263f0 by Utkarsh Gupta at 2026-10-04T08:27:23+05:30
lts: grub2 not-affected in bookworm
- - - - -
d398ab87 by Utkarsh Gupta at 2026-10-04T08:33:05+05:30
lts: usbredir postponed in bookworm
- - - - -
935d0142 by Utkarsh Gupta at 2026-10-04T08:36:54+05:30
lts: ruby-nokogiri not-affected in bookworm
- - - - -
0196d915 by Utkarsh Gupta at 2026-10-04T08:43:23+05:30
lts: triage libxml2 in bookworm
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -451,6 +451,7 @@ CVE-2026-95662 (Cross-Site Scripting vulnerability in the Repasat application. S
NOT-FOR-US: Repasat
CVE-2026-95512 (A flaw was found in FreeType, specifically within its CID font loader. ...)
- freetype <unfixed>
+ [bookworm] - freetype <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2462295
NOTE: Fixed by: https://gitlab.freedesktop.org/freetype/freetype/-/commit/f3ca71c9900fe860849b3163a6e2c1e765b291d9
CVE-2026-94658 (Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua ...)
@@ -2226,6 +2227,7 @@ CVE-2026-103387 (A weakness has been identified in garycourt uri-js up to 4.4.1.
NOTE: https://github.com/garycourt/uri-js/issues/103
CVE-2026-103001 (PyJWT is a Python implementation of JSON Web Token standards. From 2.1 ...)
- pyjwt 2.14.0-1
+ [bookworm] - pyjwt <not-affected> (Vulnerable code introduced in 2.11.0)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q
NOTE: https://github.com/jpadilla/pyjwt/issues/679
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/0c87c8c8b1a74cac99ad8115f3050efcb7fbed35 (2.14.0)
@@ -5224,6 +5226,7 @@ CVE-2026-103040 (LightLLM through 1.2.0 contains a remote code execution vulnera
NOT-FOR-US: LightLLM
CVE-2026-102938 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1149650)
+ [bookworm] - python-virtualenv <postponed> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g
NOTE: https://github.com/pypa/virtualenv/pull/3247
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140 (21.7.11)
@@ -5235,11 +5238,13 @@ CVE-2026-102937 (virtualenv is a tool for creating isolated virtual python envir
NOTE: Only impact activate.bat when running on Windows
CVE-2026-102930 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1149650)
+ [bookworm] - python-virtualenv <postponed> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45
NOTE: https://github.com/pypa/virtualenv/pull/3251
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d (21.7.12)
CVE-2026-102925 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1149650)
+ [bookworm] - python-virtualenv <not-affected> (Vulnerable code introduced in 20.33.0)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2
NOTE: https://github.com/pypa/virtualenv/pull/3252
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/4d5a105ec2a2723b8c7f4571bb68f4f71d01e3f6 (21.7.13)
@@ -5308,11 +5313,13 @@ CVE-2026-102771 (A security vulnerability has been detected in Naichen ThinkCMF
NOT-FOR-US: Naichen ThinkCMF
CVE-2026-102621 (A vulnerability was identified in Freedesktop Poppler up to 26.08.0. A ...)
- poppler <unfixed> (bug #1149698)
+ [bookworm] - poppler <postponed> (Minor issue)
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1763
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2325
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/commit/323c91036d99926a8b90dc14329f7b40aece22f8
CVE-2026-102620 (A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/ ...)
- poppler <unfixed> (bug #1149697)
+ [bookworm] - poppler <postponed> (Minor issue)
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1762
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2326
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/commit/245d3c6823377755f2c1d5fdddd010279c6ed94d
@@ -5517,6 +5524,7 @@ CVE-2026-96428 (SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpo
CVE-2026-95520 (A heap-based buffer overflow flaw was found in rpm. Parsing a symlink ...)
- rpm <unfixed>
[trixie] - rpm <no-dsa> (Minor issue)
+ [bookworm] - rpm <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2537809
CVE-2026-19395
NOT-FOR-US: Qt for MCUs
@@ -5932,6 +5940,7 @@ CVE-2026-102474 (A flaw was found in dash. The printf builtin reserves four byte
NOTE: Negligible security impact
CVE-2026-102473 (A flaw was found in dash. When built without libc fnmatch, the interna ...)
- dash <unfixed> (bug #1149887)
+ [bookworm] - dash <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543005
CVE-2026-102437 (OS Command Injection in internal/gitcmd (git diff filter.clean/smudge ...)
NOT-FOR-US: DeepSeek-Reasonix
@@ -6822,46 +6831,57 @@ CVE-2026-102276 (The brace-expansion library generates arbitrary strings contain
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/0bcbfc0a5928c3073d48f42999d1ce4fc1c42fbc (v1.1.19)
CVE-2026-102275 (PyJWT is a Python implementation of JSON Web Token standards. From 2.1 ...)
- pyjwt 2.15.0-1
+ [bookworm] - pyjwt <postponed> (Minor issue)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-x33g-cr3x-6449
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/3cd9ceec33ced359decbad75b413ad668ae6332c (2.15.0)
CVE-2026-102274 (PyJWT is a Python implementation of JSON Web Token standards. From 2.9 ...)
- pyjwt 2.14.0-1
+ [bookworm] - pyjwt <postponed> (Minor issue)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w6j9-cwv2-h6wq
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/8915570a0bfda9f0ff0e34e7fb09bdb9d71580cf (2.14.0)
CVE-2026-102273 (PyJWT is a Python implementation of JSON Web Token standards. From 2.1 ...)
- pyjwt 2.14.0-1
+ [bookworm] - pyjwt <not-affected> (Incomplete fix for CVE-2026-48526 not applied)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w2cx-738m-mc7w
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/801cd128528c62d9b23fcd161d1a2e1c17982f95 (2.14.0)
CVE-2026-102272 (PyJWT is a Python implementation of JSON Web Token standards. From 2.1 ...)
- pyjwt 2.14.0-1
+ [bookworm] - pyjwt <not-affected> (Incomplete fix for CVE-2026-48526 not applied)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-r6x4-923q-g947
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/180783930de91876bc0d601f826a1f2956057291 (2.14.0)
CVE-2026-102271 (PyJWT is a Python implementation of JSON Web Token standards. From 2.4 ...)
- pyjwt 2.14.0-1
+ [bookworm] - pyjwt <postponed> (Minor issue)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-p4g4-x82p-q773
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/2798504fa2663364573cf2d1043d8d7fef389499 (2.14.0)
CVE-2026-102270 (PyJWT is a Python implementation of JSON Web Token standards. Prior to ...)
- pyjwt 2.14.0-1
+ [bookworm] - pyjwt <postponed> (Minor issue)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jwrc-g2q2-pq5p
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07 (2.14.0)
CVE-2026-102269 (PyJWT is a Python implementation of JSON Web Token standards. Prior to ...)
- pyjwt 2.14.0-1
+ [bookworm] - pyjwt <postponed> (Minor issue)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-hxm8-2xgr-2p9m
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/e6f48401001609a8f99e71fcaf355fb895d508a8 (2.14.0)
CVE-2026-102268 (PyJWT is a Python implementation of JSON Web Token standards. Prior to ...)
- pyjwt 2.14.0-1
+ [bookworm] - pyjwt <postponed> (Minor issue)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffc3-869f-jxw9
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/8b4e233a22206b34ec1186e912e75c0b2396ac07 (2.14.0)
CVE-2026-102267 (PyJWT is a Python implementation of JSON Web Token standards. Prior to ...)
- pyjwt 2.14.0-1
+ [bookworm] - pyjwt <postponed> (Minor issue)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9v7f-9g4p-ffgj
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/0a795b8e1f6ef08f634aa7086fc41cc6d5ce3e56 (2.14.0)
CVE-2026-102266 (PyJWT is a Python implementation of JSON Web Token standards. From 2.1 ...)
- pyjwt 2.14.0-1
+ [bookworm] - pyjwt <not-affected> (Vulnerable code introduced in 2.13.0)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-9j54-fg26-wv3r
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/f91ed44dd65baaf457f4b3353ed35e98a753934c (2.14.0)
CVE-2026-102265 (PyJWT is a Python implementation of JSON Web Token standards. From 2.1 ...)
- pyjwt 2.14.0-1
+ [bookworm] - pyjwt <postponed> (Minor issue)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-8wjv-2p76-3863
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/06573692ebcdec8831c3927513b3e87c31fbbb62 (2.14.0)
CVE-2026-102264 (A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f ...)
@@ -6894,10 +6914,12 @@ CVE-2026-102004 (Wind River VxWorks 7 prior to 26.09, specific system call argum
NOT-FOR-US: WindRiver
CVE-2026-101918 (PyJWT is a Python implementation of JSON Web Token standards. From 2.0 ...)
- pyjwt 2.15.0-1
+ [bookworm] - pyjwt <postponed> (Minor issue)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-42vr-xj54-vc7v
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b (2.15.0)
CVE-2026-101917 (PyJWT is a Python implementation of JSON Web Token standards. Prior to ...)
- pyjwt 2.14.0-1
+ [bookworm] - pyjwt <postponed> (Minor issue)
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-2gx3-rcp4-g85q
NOTE: Fixed by: https://github.com/jpadilla/pyjwt/commit/ba4853a75fb9676362da17f67d0f64bd18afd4e1 (2.14.0)
CVE-2026-101916 (@grpc/grpc-js implements the core functionality of gRPC purely in Java ...)
@@ -12731,6 +12753,7 @@ CVE-2026-93205 (In the Linux kernel, the following vulnerability has been resolv
NOTE: https://git.kernel.org/linus/2bd22a0d40503a65d243b011de146603c8ce1cbc (7.3-rc1)
CVE-2026-97876 (A local attacker with control over GRUB's configuration can bypass loc ...)
- grub2 2.14-4 (bug #1148741)
+ [bookworm] - grub2 <not-affected> (Vulnerable code introduced in 2.12)
NOTE: https://www.openwall.com/lists/oss-security/2026/09/13/5
NOTE: Fixed by: https://gitlab.freedesktop.org/gnu-grub/grub/-/commit/26beaa3b2720fefdc4d04c1ae209b776fe6848d6 (grub-2.16)
CVE-2026-84680
@@ -16299,6 +16322,7 @@ CVE-2026-94368 (A flaw was found in the signature verification logic of noobaa-c
NOT-FOR-US: noobaa
CVE-2026-94640 (A flaw was found in rpcbind. This vulnerability allows a remote, unaut ...)
- rpcbind <unfixed> (bug #1148730)
+ [bookworm] - rpcbind <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2462960
CVE-2026-15801 (A vulnerability was found in CRI-O related to the container checkpoint ...)
- cri-o <itp> (bug #979702)
@@ -16353,12 +16377,14 @@ CVE-2026-93012 (Email::Sender::Transport::Sendmail versions before 2.602 for Per
NOTE: Fixed by: https://github.com/rjbs/Email-Sender/commit/9a587bc9ff4edae13239190c2651da2c76b1e72c (2.602)
CVE-2026-97687 (urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, ...)
- python-urllib3 2.8.0-1
+ [bookworm] - python-urllib3 <postponed> (Minor issue)
NOTE: https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77
NOTE: https://github.com/urllib3/urllib3/pull/5093
NOTE: Fixed by: https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465 (2.8.0)
NOTE: Fixed by: https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3 (2.8.0)
CVE-2026-97689 (urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, ...)
- python-urllib3 2.8.0-1
+ [bookworm] - python-urllib3 <postponed> (Minor issue)
NOTE: https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw
NOTE: Fixed by: https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed (2.8.0)
CVE-2026-97688 (urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, ...)
@@ -16448,6 +16474,7 @@ CVE-2026-82187 (The Web to Print Online Designer WordPress plugin before 2.15.0
CVE-2026-92382 (An out-of-bounds write flaw was found in usbredir. Starting an isochro ...)
- usbredir <unfixed> (bug #1148831)
[trixie] - usbredir <postponed> (Revisit when fixed upstream)
+ [bookworm] - usbredir <postponed> (Revisit when fixed upstream)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2535972
TODO: check details once Red Hat opens up bugzilla entry
CVE-2026-94113 (Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contai ...)
@@ -17701,10 +17728,12 @@ CVE-2026-75892 (In osmo-ggsn 1.14.0 an out of bounds write issue was found in th
NOTE: Fixed in: https://cgit.osmocom.org/osmo-ggsn/commit/?id=6c322f4dd339401a437da3c89c95f2bf64bca995 (1.15.0)
CVE-2026-85495
- ppp <unfixed> (bug #1148821)
+ [bookworm] - ppp <postponed> (Minor issue)
NOTE: https://github.com/ppp-project/ppp/security/advisories/GHSA-frhv-j822-2pvx
CVE-2026-75883 (The code in pppd that formats a response to a PEAP Request packet in p ...)
{DLA-4808-1}
- ppp <unfixed> (bug #1148816)
+ [bookworm] - ppp <not-affected> (PEAP support introduced in 2.5.0)
NOTE: https://github.com/ppp-project/ppp/security/advisories/GHSA-rwr9-4vx8-vc35
CVE-2026-75157 (Apache Airflow's asset queued-events DELETE endpoints checked the call ...)
- airflow <itp> (bug #819700)
@@ -18960,6 +18989,7 @@ CVE-2026-76834 (b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomple
NOT-FOR-US: b2evolution CMS
CVE-2026-76781 (A flaw was found in libxml2. A local user or an attacker providing a s ...)
- libxml2 2.15.4+dfsg-1
+ [bookworm] - libxml2 <postponed> (Minor issue; introduced by CVE-2026-0992 backport)
NOTE: https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/442
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/c63248941708bc1d2e3a4292954593312212f6ca (master)
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/a34c084d7a576914c1424caabdaaf5e227bb39ef (v2.15.4)
@@ -31843,6 +31873,7 @@ CVE-2026-8301 (Improper neutralization of special elements used in an OS command
NOT-FOR-US: Pardus Boot Repair
CVE-2026-89329 (A flaw was found in `multipathd`. A local attacker with access to the ...)
- multipath-tools <unfixed> (bug #1147523)
+ [bookworm] - multipath-tools <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2470013
NOTE: https://github.com/opensvc/multipath-tools/security/advisories/GHSA-hmcm-9cq4-r2xm
CVE-2026-89298 (A flaw was found in the Dynamic Client Registration service of Keycloa ...)
@@ -36238,6 +36269,7 @@ CVE-2026-75021 (fastify-cli starts the Node.js Inspector when a debug flag is us
NOT-FOR-US: fastify-cli
CVE-2026-74860 (A flaw was found in libxml2 with Python bindings enabled. A remote att ...)
- libxml2 2.15.3+dfsg-1
+ [bookworm] - libxml2 <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2529697
NOTE: https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1076
NOTE: https://gitlab.gnome.org/GNOME/libxml2/-/merge_requests/397
@@ -39256,30 +39288,38 @@ CVE-2026-8447 (IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-
NOT-FOR-US: IBM
CVE-2026-86144 (In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXInclu ...)
- libxml2 2.15.4+dfsg-1 (bug #1146744)
+ [bookworm] - libxml2 <postponed> (Minor issue)
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/b63cd517afecb76582dd9488c55e54ceaf50de61 (v2.15.4)
CVE-2026-86143 (In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteC ...)
- libxml2 2.15.4+dfsg-1 (bug #1146744)
+ [bookworm] - libxml2 <postponed> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1111
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/90f293ba74d28b1d570920382e707586f68ebf35 (v2.15.4)
CVE-2026-86142 (In libxml2 before 2.15.4, there is a heap-based buffer overflow in xml ...)
- libxml2 2.15.4+dfsg-1 (bug #1146744)
+ [bookworm] - libxml2 <postponed> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/6b3a736c0edc74ceec3d82f5252499d7911b3a58 (v2.15.4)
CVE-2026-86141 (xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in x ...)
- libxml2 2.15.4+dfsg-1 (bug #1146744)
+ [bookworm] - libxml2 <not-affected> (Vulnerable code introduced by the CVE-2026-86137 fix)
NOTE: https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1107
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/e89a8aae4c9b40cdafcf66b3f9e57c62db37bb55 (v2.15.4)
CVE-2026-86140 (In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat ...)
- libxml2 2.15.4+dfsg-1 (bug #1146744)
+ [bookworm] - libxml2 <postponed> (Minor issue)
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/d1686f91dbda141a752200419d35639fd6b38340 (v2.15.4)
CVE-2026-86139 (In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer over ...)
- libxml2 2.15.4+dfsg-1 (bug #1146744)
+ [bookworm] - libxml2 <not-affected> (Vulnerable code introduced in 2.13.0)
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/8edbbdb09f24d26a2f900141fddc2b9d014f53b0 (v2.15.4)
CVE-2026-86138 (In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer o ...)
- libxml2 2.15.4+dfsg-1 (bug #1146744)
+ [bookworm] - libxml2 <postponed> (Minor issue)
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/a4cba4b5b5a8c42e155ed42d2d2a44955465a2e4 (v2.15.4)
CVE-2026-86137 (In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds ...)
- libxml2 2.15.4+dfsg-1 (bug #1146744)
+ [bookworm] - libxml2 <not-affected> (Vulnerable code introduced in 2.15.3)
NOTE: https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1099
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/libxml2/-/commit/76fe08d97de88bfaef2f7d5cd27f11954cc5bee2 (v2.15.4)
CVE-2026-86100 (Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect ta ...)
@@ -41964,13 +42004,13 @@ CVE-2025-12737 (The administrative operations within the Carbon Console do not a
CVE-2026-XXXX [Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free and Double Free in libde265]
- libde265 1.1.2-1
[trixie] - libde265 <no-dsa> (Minor issue)
- [bookworm] - libde265 <postponed> (Minor issue)
+ [bookworm] - libde265 1.0.11-1+deb12u3
NOTE: https://github.com/strukturag/libde265/security/advisories/GHSA-xp3h-6f5r-8cxp
NOTE: https://github.com/strukturag/libde265/commit/eb346780796055d9f9aac62d725d3170aa60c7b4 (v1.1.2)
CVE-2026-XXXX [heap-use-after-free in decoder_context::reset() via dangling previous_slice_header]
- libde265 1.1.2-1
[trixie] - libde265 <no-dsa> (Minor issue)
- [bookworm] - libde265 <postponed> (Minor issue)
+ [bookworm] - libde265 1.0.11-1+deb12u3
NOTE: https://github.com/strukturag/libde265/security/advisories/GHSA-mm7m-v26f-wf8x
NOTE: https://github.com/strukturag/libde265/commit/07bc500d45f781a7e2915afb7eebc2d6d9a541c9 (v1.1.2)
CVE-2026-56855 (Previously, after a channel has been established, a malicious peer cou ...)
@@ -52044,7 +52084,7 @@ CVE-2026-79770 (Nokogiri versions before 1.19.3 contain regular expression denia
CVE-2026-79769 (Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bou ...)
- ruby-nokogiri 1.19.4+dfsg-1
[trixie] - ruby-nokogiri <no-dsa> (Minor issue)
- [bookworm] - ruby-nokogiri <postponed> (Minor issue)
+ [bookworm] - ruby-nokogiri <not-affected> (Vulnerable code introduced in 1.17.0)
NOTE: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-g9g8-vgvw-g3vf
CVE-2026-79717 (A server-side request forgery (SSRF) vulnerability was found in galaxy ...)
NOT-FOR-US: Ansible Galaxy server plugin for Pulp
@@ -76526,7 +76566,7 @@ CVE-2026-71848 (Hono is a Web application framework that provides support for an
CVE-2026-71847 (Ruby JSON is a JSON implementation for Ruby. From 2.20.0 until 2.21.2, ...)
- ruby-json 2.21.2+dfsg-1 (bug #1143948)
[trixie] - ruby-json <no-dsa> (Minor issue)
- [bookworm] - ruby-json <postponed> (Minor issue)
+ [bookworm] - ruby-json <not-affected> (Vulnerable code introduced in 2.20.0)
NOTE: https://github.com/ruby/json/security/advisories/GHSA-9hj4-r449-hfvc
NOTE: Fixed by: https://github.com/ruby/json/commit/2c332bfe2bfb0e754da07e2a0310ef106bf46482 (v2.21.2)
CVE-2026-71560 (Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. ...)
@@ -118749,7 +118789,7 @@ CVE-2026-55654 (A flaw was found in OpenSSH. This vulnerability, a heap out-of-b
- openssh-gssapi <unfixed> (bug #1143924)
- openssh 1:10.4p1-5
[trixie] - openssh <no-dsa> (Minor issue)
- [bookworm] - openssh <postponed> (Minor issue)
+ [bookworm] - openssh <not-affected> (Only affects Red Hat-specific GSSAPI indicators patch)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2462493
NOTE: openssh/1:10.4p1-5 dropped the GSS-API authentication and key exchange support
CVE-2026-55653 (A flaw was found in OpenSSH. A malicious SSH server can exploit a doub ...)
=====================================
data/dla-needed.txt
=====================================
@@ -843,6 +843,14 @@ wireshark
wordpress
NOTE: 20260807: Added by Front-Desk. Follow DSA (rouca)
--
+wpa
+ NOTE: 20261004: Added by Front-Desk (utkarsh)
+ NOTE: 20261004: netdev->root via wpa_config_write() following symlinks
+ NOTE: 20261004: (#1148985, no CVE yet; Debian's D-Bus policy lets netdev use
+ NOTE: 20261004: CreateInterface/SaveConfig). Also fix CVE-2026-78807. carnil
+ NOTE: 20261004: has a trixie-security change prepared (held for reporter
+ NOTE: 20261004: testing); follow it. (utkarsh/front-desk)
+--
xdg-dbus-proxy
NOTE: 20260927: Added by Front-Desk (ta)
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/878096a13f104e5044f149f86f844ff1236736cf...0196d915b44d818a36b3020dd2e2eefbdd076da8
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/878096a13f104e5044f149f86f844ff1236736cf...0196d915b44d818a36b3020dd2e2eefbdd076da8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261004/df30a729/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list