[Git][security-tracker-team/security-tracker][master] 4 commits: lts: wolfssl end-of-life in bookworm
Utkarsh Gupta (@utkarsh)
utkarsh at debian.org
Mon Oct 5 02:31:00 BST 2026
Utkarsh Gupta pushed to branch master at Debian Security Tracker / security-tracker
Commits:
a9a22cfa by Utkarsh Gupta at 2026-10-05T02:06:58+05:30
lts: wolfssl end-of-life in bookworm
- - - - -
10baa5a2 by Utkarsh Gupta at 2026-10-05T02:10:42+05:30
lts: libimager-perl postponed in bookworm
- - - - -
ed1e8e27 by Utkarsh Gupta at 2026-10-05T02:12:44+05:30
lts: webpy postponed in bookworm
- - - - -
b3b98243 by Utkarsh Gupta at 2026-10-05T02:16:25+05:30
lts: epiphany-browser postponed in bookworm
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -208,6 +208,7 @@ CVE-2026-103065 (Improper Validation of Specified Quantity in Input vulnerabilit
NOT-FOR-US: WordPress plugin or theme
CVE-2026-94291
- epiphany-browser 51.1-1
+ [bookworm] - epiphany-browser <postponed> (Limited support)
NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2952
NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2214
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/epiphany/-/commit/274794198e2bfc7257c72d0d94946e2a4f61b826 (51.1)
@@ -2117,6 +2118,7 @@ CVE-2026-102505 (Imager versions before 1.037 for Perl overflow a heap buffer fe
[experimental] - libimager-perl 1.037+dfsg-1
- libimager-perl <unfixed>
[trixie] - libimager-perl <no-dsa> (Minor issue)
+ [bookworm] - libimager-perl <postponed> (Minor issue; overflow only via getsamples(type => 'float') on paletted images)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/43998313/
NOTE: https://github.com/tonycoz/imager/security/advisories/GHSA-4rx6-cgv3-fmxp
NOTE: Fixed by: https://github.com/tonycoz/imager/commit/aae49c6be065aa467e834105c816359394a634db (v1.037)
@@ -2124,6 +2126,7 @@ CVE-2026-102504 (Imager versions before 1.037 for Perl exit the process reading
[experimental] - libimager-perl 1.037+dfsg-1
- libimager-perl <unfixed>
[trixie] - libimager-perl <no-dsa> (Minor issue)
+ [bookworm] - libimager-perl <postponed> (Minor issue; needs an untrusted raw_datachannels option passed to read())
NOTE: https://lists.security.metacpan.org/cve-announce/msg/43998314/
NOTE: https://github.com/tonycoz/imager/security/advisories/GHSA-g549-r73g-x7x6
NOTE: Fixed by: https://github.com/tonycoz/imager/commit/21b0df9eef1dffe1fdcd3706bfea9f1338031679 (v1.037)
@@ -7961,14 +7964,17 @@ CVE-2026-94418 (Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the
CVE-2026-94417 (When an application enables both OCSP and CRL revocation checking on o ...)
- wolfssl <unfixed>
[trixie] - wolfssl <no-dsa> (Minor issue)
+ [bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
NOTE: https://github.com/wolfSSL/wolfssl/pull/11500 (v5.9.4-stable)
CVE-2026-93304 (A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it ha ...)
- wolfssl <unfixed>
[trixie] - wolfssl <no-dsa> (Minor issue)
+ [bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
NOTE: https://github.com/wolfSSL/wolfssl/pull/11458 (v5.9.4-stable)
CVE-2026-93302 (MatchTrustedPeer ignores the public key used, leading to forged CA clo ...)
- wolfssl <unfixed>
[trixie] - wolfssl <no-dsa> (Minor issue)
+ [bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
NOTE: Fixed by: https://github.com/wolfSSL/wolfssl/commit/22bcd51d553eaac1de37bee91fdac80cc47961e1 (v5.9.4-stable)
CVE-2026-89136 (When using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and ...)
- wolfssl <unfixed>
@@ -7983,6 +7989,7 @@ CVE-2026-89135 (A failed X509_verify_cert call permanently plants an unverified
CVE-2026-89134 (A certificate with no dNSName SAN but another SAN type present (e.g. r ...)
- wolfssl <unfixed>
[trixie] - wolfssl <no-dsa> (Minor issue)
+ [bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10837 (v5.9.4-stable)
CVE-2026-89133 (wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certifi ...)
- wolfssl <unfixed>
@@ -8013,6 +8020,7 @@ CVE-2026-88771 (Improper input validation vulnerability in Citrix NetScaler ADC
CVE-2026-15442 (In all builds that make use of (D)TLS, including default builds, there ...)
- wolfssl <unfixed>
[trixie] - wolfssl <no-dsa> (Minor issue)
+ [bookworm] - wolfssl <end-of-life> (EOL in bookworm LTS)
NOTE: https://github.com/wolfSSL/wolfssl/pull/10863 (v5.9.4-stable)
CVE-2026-101061 (utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-s ...)
NOT-FOR-US: utcp
@@ -13564,6 +13572,7 @@ CVE-2026-79616 (Out-of-bounds read while parsing untrusted SVG path strings in Q
CVE-2026-79310 (webpy web.py 0.76 is vulnerable to server-side template injection (SST ...)
- webpy <unfixed>
[trixie] - webpy <no-dsa> (Minor issue)
+ [bookworm] - webpy <postponed> (Minor issue)
NOTE: https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79310.md
CVE-2026-79306 (CyberPanel v1.9.1 contains a path traversal vulnerability in the compr ...)
NOT-FOR-US: CyberPanel
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/ecec5f9f92e621d4e506a65a03be35f415dffae1...b3b98243cb5fef198eb943b240a883589eb174c4
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/ecec5f9f92e621d4e506a65a03be35f415dffae1...b3b98243cb5fef198eb943b240a883589eb174c4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261005/796c5d8f/attachment.htm>
More information about the debian-security-tracker-commits
mailing list