[Git][security-tracker-team/security-tracker][master] 6 commits: lts: streamlink postponed in bookworm
Utkarsh Gupta (@utkarsh)
utkarsh at debian.org
Mon Oct 5 02:35:28 BST 2026
Utkarsh Gupta pushed to branch master at Debian Security Tracker / security-tracker
Commits:
57cd27cc by Utkarsh Gupta at 2026-10-05T02:27:04+05:30
lts: streamlink postponed in bookworm
- - - - -
a0fc7ac2 by Utkarsh Gupta at 2026-10-05T02:30:09+05:30
lts: dask postponed in bookworm
- - - - -
11803a52 by Utkarsh Gupta at 2026-10-05T02:32:10+05:30
lts: node-katex postponed in bookworm
- - - - -
ed5036a4 by Utkarsh Gupta at 2026-10-05T02:36:48+05:30
lts: restrictedpython postponed in bookworm
- - - - -
06a6c54f by Utkarsh Gupta at 2026-10-05T02:39:34+05:30
dla-needed: add chromium
- - - - -
74aa624d by Utkarsh Gupta at 2026-10-05T02:44:28+05:30
lts: node-brace-expansion postponed in bookworm
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -1787,6 +1787,7 @@ CVE-2026-104018 (An improper privilege management vulnerability (CWE-269) exists
CVE-2026-103923 (KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering ...)
- node-katex 0.16.10+~cs6.1.0-10 (bug #1149653)
[trixie] - node-katex <no-dsa> (Minor issue)
+ [bookworm] - node-katex <postponed> (Minor issue)
NOTE: https://github.com/KaTeX/KaTeX/security/advisories/GHSA-238p-pmpm-9mq7
NOTE: https://github.com/KaTeX/KaTeX/pull/4260
NOTE: Fixed by: https://github.com/KaTeX/KaTeX/commit/0adf7e77db6915d991803b29699f82b1ccf8d4f4 (v0.18.2)
@@ -6916,6 +6917,7 @@ CVE-2026-102279 (Laravel is a web application framework. Prior to 12.69.0 and 13
CVE-2026-102278 (The brace-expansion library generates arbitrary strings containing a c ...)
- node-brace-expansion 2.1.7+~1.1.2-1 (bug #1149649)
[trixie] - node-brace-expansion <no-dsa> (Minor issue)
+ [bookworm] - node-brace-expansion <postponed> (Minor issue)
NOTE: https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-qhr7-859c-m2p7
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/935d78f32f335b2ff76578e5c5e877d31ae9888c (v5.0.11)
NOTE: Fxied by: https://github.com/juliangruber/brace-expansion/commit/de84f144e9816f30e25fc8179e2e1249ab6df0db (v3.0.8)
@@ -6924,6 +6926,7 @@ CVE-2026-102278 (The brace-expansion library generates arbitrary strings contain
CVE-2026-102277 (The brace-expansion library generates arbitrary strings containing a c ...)
- node-brace-expansion 2.1.7+~1.1.2-1 (bug #1149649)
[trixie] - node-brace-expansion <no-dsa> (Minor issue)
+ [bookworm] - node-brace-expansion <postponed> (Minor issue)
NOTE: https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-q2hr-2g5m-vwhr
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/33a5ef17b8d800bbfa8c52b14c39043b6aac1a96 (v5.0.12)
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/c55e67d8d8b1c56a2474afff15c2891166b2d364 (v3.0.9)
@@ -6932,6 +6935,7 @@ CVE-2026-102277 (The brace-expansion library generates arbitrary strings contain
CVE-2026-102276 (The brace-expansion library generates arbitrary strings containing a c ...)
- node-brace-expansion 2.1.7+~1.1.2-1 (bug #1149649)
[trixie] - node-brace-expansion <no-dsa> (Minor issue)
+ [bookworm] - node-brace-expansion <postponed> (Minor issue)
NOTE: https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-6j4f-fj2g-mc7p
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/6735c94873ca570bcdd6a0690033bdd3126379d3 (v5.0.10)
NOTE: Fixed by: https://github.com/juliangruber/brace-expansion/commit/316359e6019c39b3254c8ba8e25dc586a480652c (v3.0.7)
@@ -13279,6 +13283,7 @@ CVE-2026-92284 (Caddy is an extensible server platform that uses TLS by default.
CVE-2026-92164 (Streamlink is a CLI utility which pipes video streams from various ser ...)
- streamlink 8.6.0-1
[trixie] - streamlink <no-dsa> (Minor issue)
+ [bookworm] - streamlink <postponed> (Minor issue)
NOTE: https://github.com/streamlink/streamlink/security/advisories/GHSA-vf2x-4v53-pm7v
NOTE: https://github.com/streamlink/streamlink/commit/4b99c64dde21ea70c24d9ffdbd15849b05f465c6 (8.6.0)
CVE-2026-92001 (Improper restriction of recursive entity references in DTDs ('XML enti ...)
@@ -14414,6 +14419,7 @@ CVE-2026-95924 (A vulnerability has been found in SourceCodester Online Reviewer
CVE-2026-95897 (A security vulnerability has been detected in Dask up to 2026.8.0. Thi ...)
- dask <unfixed>
[trixie] - dask <no-dsa> (Minor issue)
+ [bookworm] - dask <postponed> (Minor issue)
NOTE: https://github.com/dask/dask/issues/12578
CVE-2026-95868 (A weakness has been identified in AdithyaYelloju Restaurant-Management ...)
NOT-FOR-US: AdithyaYelloju Restaurant-Management-System
@@ -118397,6 +118403,7 @@ CVE-2026-54503 (plone.app.textfield provides a zope.schema-style field type call
CVE-2026-55830 (RestrictedPython is a tool that helps to define a subset of the Python ...)
- restrictedpython 8.4-1
[trixie] - restrictedpython <no-dsa> (Minor issue)
+ [bookworm] - restrictedpython <postponed> (Minor issue)
NOTE: https://github.com/zopefoundation/RestrictedPython/security/advisories/GHSA-ffg3-p8fm-mjx2
NOTE: Fixed by: https://github.com/zopefoundation/RestrictedPython/commit/3737596ec9f28c34a073cc845bd2f4c0a80cb671 (8.3)
CVE-2026-55099 (icalendar is an RFC 5545 compatible parser and generator of iCalendar ...)
=====================================
data/dla-needed.txt
=====================================
@@ -98,6 +98,13 @@ caddy
NOTE: 20260715: Added by Front-Desk (Beuc)
NOTE: 20260715: Upcoming DSA (Beuc/front-desk)
--
+chromium
+ NOTE: 20261004: Added by Front-Desk (utkarsh)
+ NOTE: 20261004: CVE-2026-103621..103631 are fixed in 154.0.8037.97. DLA-4811-1
+ NOTE: 20261004: shipped 154.0.8037.92 (CVE-2026-102299..102331), which does
+ NOTE: 20261004: not cover them. chromium is back in dsa-needed: follow the
+ NOTE: 20261004: next DSA. (utkarsh/front-desk)
+--
cjose
NOTE: 20260912: Added by Front-Desk (eamanu)
NOTE: 20260914: Ivo Marino sent patches to the debian-lts list (santiago)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/a1e70ccdebd0381b873584e1bd95da40f650c4d9...74aa624d0156c5ad5e17b807937e0dd990c1a7f1
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/a1e70ccdebd0381b873584e1bd95da40f650c4d9...74aa624d0156c5ad5e17b807937e0dd990c1a7f1
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261005/3d14d3db/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list