[Git][security-tracker-team/security-tracker][master] trixie triage

Moritz Muehlenhoff (@jmm) jmm at debian.org
Mon Oct 5 15:12:30 BST 2026 


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f1cbdc23 by Moritz Muehlenhoff at 2026-10-05T16:11:45+02:00
trixie triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -88,6 +88,7 @@ CVE-2026-20519 (In Modem, there is a possible out of bounds write due to a missi
 	NOT-FOR-US: MediaTek
 CVE-2026-19954 (Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command ...)
 	- libnet-whois-raw-perl <unfixed>
+	[trixie] - libnet-whois-raw-perl <no-dsa> (Minor issue)
 	NOTE: https://github.com/regru/Net-Whois-Raw/issues/34
 	NOTE: https://github.com/regru/Net-Whois-Raw/pull/35
 	NOTE: Fixed by: https://security.metacpan.org/patches/N/Net-Whois-Raw/2.99043/CVE-2026-19954-r1.patch
@@ -412,6 +413,7 @@ CVE-2026-103065 (Improper Validation of Specified Quantity in Input vulnerabilit
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-94291
 	- epiphany-browser 51.1-1
+	[trixie] - epiphany-browser <no-dsa> (Minor issue)
 	[bookworm] - epiphany-browser <postponed> (Limited support)
 	NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/work_items/2952
 	NOTE: https://gitlab.gnome.org/GNOME/epiphany/-/merge_requests/2214
@@ -1357,6 +1359,7 @@ CVE-2026-103600 (Uncontrolled recursion in the ASN.1 parser (Asn1InputStream, As
 	NOT-FOR-US: Bouncycastle components not packaged in Debian
 CVE-2026-103552 (Stack Overflow vulnerability in Apache Directory LDAP API.    Before b ...)
 	- apache-directory-api <unfixed> (bug #1149877)
+	[trixie] - apache-directory-api <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2026/10/02/4
 CVE-2026-103426 (The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cr ...)
 	NOT-FOR-US: WordPress plugin
@@ -1371,6 +1374,7 @@ CVE-2026-102772 (The CMB2 plugin for WordPress is vulnerable to Stored Cross-Sit
 	NOT-FOR-US: WordPress plugin
 CVE-2026-102731 (Memory allocation with excessive size value vulnerability in Apache Di ...)
 	- apache-directory-api <unfixed> (bug #1149877)
+	[trixie] - apache-directory-api <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2026/10/02/3
 CVE-2026-102626 (An authenticated LimeSurvey Community Edition 7.4.0user with the globa ...)
 	- limesurvey <itp> (bug #472802)
@@ -5691,24 +5695,26 @@ CVE-2026-103040 (LightLLM through 1.2.0 contains a remote code execution vulnera
 	NOT-FOR-US: LightLLM
 CVE-2026-102938 (virtualenv is a tool for creating isolated virtual python environments ...)
 	- python-virtualenv <unfixed> (bug #1149650)
+	[trixie] - python-virtualenv <no-dsa> (Minor issue)
 	[bookworm] - python-virtualenv <postponed> (Minor issue)
 	NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-9h9j-4vrj-gf7g
 	NOTE: https://github.com/pypa/virtualenv/pull/3247
 	NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/a30f995461043acb6cacbf3a890951563ccf7140 (21.7.11)
 CVE-2026-102937 (virtualenv is a tool for creating isolated virtual python environments ...)
-	- python-virtualenv <unfixed> (unimportant)
+	- python-virtualenv <not-affected> (Windows-specific)
 	NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-x78j-v8h9-3j2q
 	NOTE: https://github.com/pypa/virtualenv/pull/3250
 	NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/d721ff140ce4afdc2a9b76751e4584e25d9fbea6 (21.7.12)
-	NOTE: Only impact activate.bat when running on Windows
 CVE-2026-102930 (virtualenv is a tool for creating isolated virtual python environments ...)
 	- python-virtualenv <unfixed> (bug #1149650)
+	[trixie] - python-virtualenv <no-dsa> (Minor issue)
 	[bookworm] - python-virtualenv <postponed> (Minor issue)
 	NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-94p9-xgh2-xp45
 	NOTE: https://github.com/pypa/virtualenv/pull/3251
 	NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/a01ed3e2f239d6ab1fce62c5c7664ccf268fff6d (21.7.12)
 CVE-2026-102925 (virtualenv is a tool for creating isolated virtual python environments ...)
 	- python-virtualenv <unfixed> (bug #1149650)
+	[trixie] - python-virtualenv <no-dsa> (Minor issue)
 	[bookworm] - python-virtualenv <not-affected> (Vulnerable code introduced in 20.33.0)
 	NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-p58f-9548-mpm2
 	NOTE: https://github.com/pypa/virtualenv/pull/3252
@@ -6175,11 +6181,12 @@ CVE-2026-11796 (Asset Suite allows unauthenticated users to access PropertiesRel
 CVE-2026-10518 (GitLab has remediated an issue in GitLab EE affecting all versions fro ...)
 	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
 CVE-2026-102831 (JupyterLab is an extensible environment for interactive and reproducib ...)
-	- jupyterlab <unfixed>
+	- jupyterlab <not-affected> (Vulnerable code introduced later)
 	- jupyter-notebook <unfixed>
 	NOTE: https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-6966-vjj6-99xv
 	NOTE: Fixed by: https://github.com/jupyterlab/jupyterlab/commit/7f9f29e29e0c83fb17b0f11da57d06b3c6a40d96 (v4.5.11)
-	TODO: check, might be introduced later in both products
+	NOTE: Introduced by: https://github.com/jupyterlab/jupyterlab/commit/e5bc7eaaa7315e2d56bfd482efe4302e6a894c33 (v4.5.0a)
+	TODO: check, might be introduced later
 CVE-2026-102830 (JupyterLab is an extensible environment for interactive and reproducib ...)
 	- jupyterlab <unfixed> (bug #1149998)
 	NOTE: https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-3jqq-pw4j-pqcj
@@ -7043,6 +7050,8 @@ CVE-2026-100831 (Use-after-free in the DOM: UI Events & Focus Handling component
 	- firefox 157.0-1
 	- firefox-esr 153.4.0esr-1
 	- thunderbird 1:153.4.0esr-1
+	[trixie] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
+	[bookworm] - thunderbird <not-affected> (Vulnerable code not present, doesn't affect ESR140)
 	NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-97/#CVE-2026-100831
 	NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-100/#CVE-2026-100831
 	NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-103/#CVE-2026-100831
@@ -8463,6 +8472,7 @@ CVE-2026-XXXX [Infinite loops and heap OOB read when parsing malformed ASF heade
 	[bookworm] - libmms <postponed> (Minor issue; client-side DoS when connecting to a malicious MMS server)
 CVE-2026-XXXX [unbounded list indices from a Word document reach a wild pointer dereference in wvAssembleSimplePAP]
 	- wv <unfixed> (bug #1148725)
+	[trixie] - wv <no-dsa> (Minor issue)
 CVE-2026-XXXX [GHSA-h547-rmjf-5m2m: Table permission bypass using trailing newlines in table names]
 	- datasette 0.65.5+ds-1 (bug #1148576)
 	NOTE: https://github.com/simonw/datasette/security/advisories/GHSA-h547-rmjf-5m2m
@@ -38588,8 +38598,8 @@ CVE-2026-20293 (A vulnerability in the Unified Extensible Firmware Interface (UE
 	NOT-FOR-US: Cisco
 CVE-2026-19614 (The API is prone to XML external entity (XXE) injection. By default, X ...)
 	- libnanoxml2-java <unfixed>
+	[trixie] - libnanoxml2-java <no-dsa> (Minor issue)
 	NOTE: https://www.thalesgroup.com/en/search/cybersecurity/cybersecurity-services/cve-2026-19614
-	TODO: check details as reference not accessible
 CVE-2026-19203 (A client may issue specially crafted HTTP/1.1 chunked requests to a Je ...)
 	- jetty12 12.0.39-1
 	- jetty9 <unfixed>
@@ -239667,13 +239677,7 @@ CVE-2025-34500 (Deck Mate 2's firmware update mechanism accepts packages without
 CVE-2025-34293 (GN4 Publishing System versions prior to 2.6 contain an insecure direct ...)
 	NOT-FOR-US: GN4 Publishing System
 CVE-2025-12194 (Uncontrolled Resource Consumption vulnerability in Legion of the Bounc ...)
-	- bouncycastle <unfixed> (bug #1118945)
-	[trixie] - bouncycastle <no-dsa> (Minor issue)
-	[bookworm] - bouncycastle <no-dsa> (Minor issue)
-	[bullseye] - bouncycastle <ignored> (Minor issue)
-	NOTE: Fixed by: https://github.com/bcgit/bc-lts-java/commit/f2776feac0c30230f7a5ac34eb24f5019caf0324 (r2rv73dot8)
-	NOTE: Followup: https://github.com/bcgit/bc-lts-java/commit/2c9be6c64152ce48c6afc784c042a514be71ec71 (r2rv73dot8)
-	NOTE: https://github.com/bcgit/bc-java/wiki/CVE%E2%80%902025%E2%80%9012194
+	NOT-FOR-US: Bouncycastle components not packaged in Debian
 CVE-2025-12095 (The Simple Registration for WooCommerce plugin for WordPress is vulner ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2025-12034 (The Fast Velocity Minify plugin for WordPress is vulnerable to Stored  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f1cbdc2385bb3f517761ec4e8f13f87c9c1238ce

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f1cbdc2385bb3f517761ec4e8f13f87c9c1238ce
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261005/4a9d4330/attachment.htm>

More information about the debian-security-tracker-commits mailing list