[Git][security-tracker-team/security-tracker][master] u-boot fixed in experimental
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Sun Oct 4 19:11:35 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
979b62f4 by Moritz Muehlenhoff at 2026-10-04T18:19:50+02:00
u-boot fixed in experimental
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -5089,6 +5089,7 @@ CVE-2026-75824 (The User Frontend WordPress plugin before 4.3.12 does not check
CVE-2026-75823 (The User Frontend WordPress plugin before 4.3.12 does not prevent tam ...)
NOT-FOR-US: WordPress plugin
CVE-2026-74225 (U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp ...)
+ [experimental] - u-boot 2026.10~rc5-1
- u-boot <unfixed> (bug #1149671)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Introduced with: https://github.com/u-boot/u-boot/commit/a0245818f7f8e375abc00f36ff88326331e4e2f9 (v2023.07-rc2)
@@ -5098,11 +5099,13 @@ CVE-2026-74222 (U-Boot before 2026.10-rc5 contains a use-after-free vulnerabilit
NOTE: Introduced with: https://github.com/u-boot/u-boot/commit/e40c910e88a9a38ee1335ab1391dc2ee83993a65 (v2025.07-rc3)
NOTE: Fixed by: https://github.com/u-boot/u-boot/commit/2d94618a58aeb7630f18eee33419ce48d0fd3616 (v2026.10-rc5)
CVE-2026-74221 (U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_readlink_r ...)
+ [experimental] - u-boot 2026.10~rc5-1
- u-boot <unfixed> (bug #1149671)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Introduced with: https://github.com/u-boot/u-boot/commit/cf3a4f1e86ecdd24f87b615051b49d8e1968c230 (v2019.10-rc4)
NOTE: Fixed by: https://github.com/u-boot/u-boot/commit/1c0aff3a5fbfeee7a8948f624e0b8554e6e0d8fd (v2026.10-rc5)
CVE-2026-74220 (U-Boot before 2026.10-rc5 contains a buffer overflow in nfs_read_reply ...)
+ [experimental] - u-boot 2026.10~rc5-1
- u-boot <unfixed> (bug #1149671)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Introduced with: https://github.com/u-boot/u-boot/commit/aa207cf3a6d68f39d64cd29057a4fb63943e9078 (v2019.10-rc4)
@@ -5116,6 +5119,7 @@ CVE-2026-71974 (U-Boot before 2026.10-rc3 contains an out-of-bounds write vulner
NOTE: Introduced with: https://github.com/u-boot/u-boot/commit/abadcda24b100b8eb0f138085cca6595518cec85 (v2025.04-rc1)
NOTE: Fixed by: https://github.com/u-boot/u-boot/commit/35432ef6fe2c79ab72709966e64815a45eb55c76 (v2026.10-rc3)
CVE-2026-71973 (U-Boot before 2026.10-rc4 contains an integer overflow vulnerability i ...)
+ [experimental] - u-boot 2026.10~rc5-1
- u-boot <unfixed> (bug #1149671)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Introduced with: https://github.com/u-boot/u-boot/commit/c51006130370b48b7eb5a93ada745385aa27f6bf (v2020.10-rc2)
@@ -5125,6 +5129,7 @@ CVE-2026-71972 (U-Boot through 2026.10-rc5 contains an out-of-bounds write vulne
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/u-boot/u-boot/commit/5201e83342d64c2f438ea35158575f28225e752e
CVE-2026-71971 (U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an ou ...)
+ [experimental] - u-boot 2026.10~rc5-1
- u-boot <unfixed> (bug #1149671)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/u-boot/u-boot/commit/04ca915d5bf39dda5d1bce62d04d2b59d293c5b9 (v2026.10-rc3)
@@ -5692,6 +5697,7 @@ CVE-2026-19547 (Ghostscript for Windows is vulnerable to local privilege escalat
- ghostscript <not-affected> (Only affects Ghostscript on Windows)
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=709522
CVE-2026-15390 (Das U-Bootwith CONFIG_IP_DEFRAG=y parameter fails to clear IP reassemb ...)
+ [experimental] - u-boot 2026.10~rc5-1
- u-boot <unfixed> (bug #1149671)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Fixed by: https://source.denx.de/u-boot/u-boot/-/commit/b1aec609bb5e0d08c25c888c91935287ab4ee5fa (v2026.07)
@@ -49157,21 +49163,25 @@ CVE-2026-13414 (The CMP WordPress plugin before 4.1.18 does not perform authori
CVE-2025-70340 (A Broken Access Control vulnerability exists in ThingsBoard Profession ...)
NOT-FOR-US: ThingsBoard
CVE-2025-70293 (An issue was discovered in Denx U-Boot before 2026.04. An integer over ...)
+ [experimental] - u-boot 2026.10~rc5-1
- u-boot <unfixed> (bug #1146625)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/08/28/4
NOTE: https://source.denx.de/u-boot/u-boot/-/commit/fc16c847a1c9c6e0ee1f605849cc500a04c21602 (v2026.04-rc1)
CVE-2025-70292
+ [experimental] - u-boot 2026.10~rc5-1
- u-boot <unfixed> (bug #1146625)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/08/28/4
NOTE: https://source.denx.de/u-boot/u-boot/-/commit/870aff99a279ed428c5a2560b2441b3079ddb34b (v2026.04-rc1)
CVE-2025-70291
+ [experimental] - u-boot 2026.10~rc5-1
- u-boot <unfixed> (bug #1146625)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/08/28/4
NOTE: https://source.denx.de/u-boot/u-boot/-/commit/99416665f006b925db12f6c02b11f9da02c10c5a (v2026.04-rc1)
CVE-2025-70290 (An issue was discovered in Denx U-Boot before 2026.04. An integer over ...)
+ [experimental] - u-boot 2026.10~rc5-1
- u-boot <unfixed> (bug #1146625)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/08/28/4
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/979b62f4235605edef093cd2c6b3a7ff357f8fd1
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/979b62f4235605edef093cd2c6b3a7ff357f8fd1
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261004/5e92973d/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list