[Git][security-tracker-team/security-tracker][master] libreoffice, sabnzbdplus DSAs

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
917bb155 by Moritz Mühlenhoff at 2026-10-05T19:26:32+02:00
libreoffice, sabnzbdplus DSAs

- - - - -


3 changed files:

- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -53192,17 +53192,21 @@ CVE-2026-63676
 	NOTE: Fixed by: https://github.com/ingydotnet/yaml-pm/commit/9388c6a02a66db79f9d2b3727b5588272f612cf1 (v1.320.0)
 CVE-2026-XXXX [GHSA-q326-jpxx-jmjc: __wrapped__ dispatch bypass allows unauthenticated API access]
 	- sabnzbdplus 5.1.3+dfsg-1 (bug #1147154)
+	[trixie] - sabnzbdplus 4.5.0+dfsg-1+deb13u2
 	NOTE: https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-q326-jpxx-jmjc
 CVE-2026-XXXX [GHSA-mjwj-v5mr-cmcg: PAR2 symlink bypass allows pickle remote code execution.]
 	- sabnzbdplus 5.1.3+dfsg-1 (bug #1147154)
+	[trixie] - sabnzbdplus 4.5.0+dfsg-1+deb13u2
 	NOTE: https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-mjwj-v5mr-cmcg
 CVE-2026-XXXX [GHSA-rgqj-28c2-gxwp: Unauthenticated API mode confusion allows configuration takeover and remote code execution]
 	- sabnzbdplus 5.1.2+dfsg-1 (bug #1145563)
+	[trixie] - sabnzbdplus 4.5.0+dfsg-1+deb13u2
 	NOTE: https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-rgqj-28c2-gxwp
 	NOTE: Fixed by: https://github.com/sabnzbd/sabnzbd/commit/a0e24089338e4a9b214a439e6dba2ee489195847 (5.1.2)
 	NOTE: Fixed by: https://github.com/sabnzbd/sabnzbd/commit/6525703a94cfdb6c8add5c6f91bc073a7e928ed5 (5.1.2)
 CVE-2026-XXXX [GHSA-75g3-96fr-7p2r: SABnzbd PAR2 path traversal enabling cross-job __verified__ pickle RCE]
 	- sabnzbdplus 5.1.2+dfsg-1 (bug #1145563)
+	[trixie] - sabnzbdplus 4.5.0+dfsg-1+deb13u2
 	NOTE: https://github.com/sabnzbd/sabnzbd/security/advisories/GHSA-75g3-96fr-7p2r
 	NOTE: Fixed by: https://github.com/sabnzbd/sabnzbd/commit/6ddabb5a4599731b00f44162e62f31e291d2b2d0 (5.1.2)
 	NOTE: Fixed by: https://github.com/sabnzbd/sabnzbd/commit/c57af32131216de3e1df3097a0cce06c8c99ceb8 (5.1.2)


=====================================
data/DSA/list
=====================================
@@ -1,3 +1,8 @@
+[05 Oct 2026] DSA-6544-1 sabnzbdplus - security update
+	[trixie] - sabnzbdplus 4.5.0+dfsg-1+deb13u2
+[05 Oct 2026] DSA-6543-1 libreoffice - security update
+	{CVE-2026-63266 CVE-2026-63267 CVE-2026-63268 CVE-2026-63269 CVE-2026-63270 CVE-2026-63277}
+	[trixie] - libreoffice 4:25.2.3-2+deb13u8
 [04 Oct 2026] DSA-6542-1 ruby-rack-session - security update
 	{CVE-2026-39324}
 	[trixie] - ruby-rack-session 2.1.1-0.1+deb13u1


=====================================
data/dsa-needed.txt
=====================================
@@ -80,8 +80,6 @@ kitty
 --
 libnet-idn-encode-perl (carnil)
 --
-libreoffice (jmm)
---
 linux (carnil)
   Wait until more issues have piled up, though try to regulary rebase for point
   releases to more 6.12.y versions
@@ -164,9 +162,6 @@ runc
 rust-wasmtime
   for CVE-2026-34987 CVE-2026-34971, rest would also be fine to ignore
 --
-sabnzbdplus (jmm)
-  Maintainer is proposing an update for review in https://bugs.debian.org/1147154#17
---
 shaarli
 --
 social-auth-core



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/917bb1552fd5621d9e37974cdca2e520775335af

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/917bb1552fd5621d9e37974cdca2e520775335af
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261005/19d8763a/attachment-0001.htm>