[Git][security-tracker-team/security-tracker][master] trixie triage

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8adb2750 by Moritz Muehlenhoff at 2026-10-04T23:32:28+02:00
trixie triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -2262,7 +2262,7 @@ CVE-2026-12241 (The Advanced Woo Labels \u2013 Product Labels & Badges for WooCo
 CVE-2026-103641 (A flaw was found in GEGL. The Radiance HDR loader reads past the end o ...)
 	- gegl <unfixed>
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2544420
-	TODO: check status upstream
+	NOTE: https://gitlab.gnome.org/GNOME/gegl/-/commit/75214d1e6893d5a6b418a62ae6953a121c371a32
 CVE-2026-103592 (simple-php-router through 5.4.1.7 contains an IP restriction bypass vu ...)
 	NOT-FOR-US: simple-php-router
 CVE-2026-103591 (DeepWiki-Open through commit d92819a contains an unauthenticated arbit ...)
@@ -2307,15 +2307,18 @@ CVE-2026-103532 (A vulnerability has been found in immich-app Immich up to 2.7.5
 	NOT-FOR-US: immich-app Immich
 CVE-2026-103531 (A flaw has been found in OpenSC up to 0.27.1. The impacted element is  ...)
 	- opensc <unfixed> (bug #1149970)
+	[trixie] - opensc <no-dsa> (Minor issue)
 	NOTE: https://github.com/OpenSC/OpenSC/pull/3812
 	NOTE: Fixed by: https://github.com/OpenSC/OpenSC/commit/ad730304052937c32b4eb489a06835ac6123632c
 CVE-2026-103530 (A vulnerability was detected in decolua 9Router up to 0.5.55. The affe ...)
 	NOT-FOR-US: decolua 9Router
 CVE-2026-103387 (A weakness has been identified in garycourt uri-js up to 4.4.1. This a ...)
 	- node-uri-js <unfixed> (bug #1149972)
+	[trixie] - node-uri-js <no-dsa> (Minor issue)
 	NOTE: https://github.com/garycourt/uri-js/issues/103
 CVE-2026-103001 (PyJWT is a Python implementation of JSON Web Token standards. From 2.1 ...)
 	- pyjwt 2.14.0-1
+	[trixie] - pyjwt <not-affected> (Vulnerable code not present)
 	[bookworm] - pyjwt <not-affected> (Vulnerable code introduced in 2.11.0)
 	NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-gvp8-978c-rx2q
 	NOTE: https://github.com/jpadilla/pyjwt/issues/679


=====================================
data/dsa-needed.txt
=====================================
@@ -158,7 +158,7 @@ runc
 rust-wasmtime
   for CVE-2026-34987 CVE-2026-34971, rest would also be fine to ignore
 --
-sabnzbdplus
+sabnzbdplus (jmm)
   Maintainer is proposing an update for review in https://bugs.debian.org/1147154#17
 --
 shaarli



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8adb275017fd6e9c8efa590fdd10fac8d1e5062a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8adb275017fd6e9c8efa590fdd10fac8d1e5062a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261004/6424c5f0/attachment.htm>