[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2026-34743/xz-utils: reference test case

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c394ff9c by Sylvain Beucler at 2026-10-06T16:43:22+02:00
CVE-2026-34743/xz-utils: reference test case

- - - - -
b1766e7e by Sylvain Beucler at 2026-10-06T16:50:38+02:00
GHSA-5qpq-xqfv-j9pg/xz-utils: reference test case

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -35552,6 +35552,7 @@ CVE-2026-XXXX [GHSA-5qpq-xqfv-j9pg: Invalid write if a decoder is reinitialized
 	NOTE: Fixed by: https://github.com/tukaani-project/xz/commit/fe4d763d566a38ad61d4c5022520c25578a3a464 (v5.8.4)
 	NOTE: Fixed by: https://github.com/tukaani-project/xz/commit/e5e63d50eac1b4357a5a7a0abd3c5f99a5c47881 (v5.8.4)
 	NOTE: Fixed by: https://github.com/tukaani-project/xz/commit/c3b290c3dc536d16884a6c695618eb08fdbc700a (v5.8.4)
+	NOTE: Test case: https://github.com/tukaani-project/xz/commit/ff834f25ae4f9b3e6270d41b4c843b8b1183346c (v5.8.4)
 CVE-2026-19816 (A flaw was found in PackageKit. PackageKit skips the polkit authorizat ...)
 	- packagekit 1.4.0-1 (unimportant)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2515940
@@ -175831,6 +175832,8 @@ CVE-2026-34743 (XZ Utils provide a general-purpose data-compression library plus
 	[bookworm] - xz-utils 5.4.1-1+deb12u1
 	NOTE: https://tukaani.org/xz/index-append-overflow.html
 	NOTE: Fixed by: https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87 (v5.8.3)
+	NOTE: Test case: https://github.com/tukaani-project/xz/commit/a3ea8832bec11128597c454f5d14d05ef6010e3f (v5.8.3)
+	NOTE: Test note: https://github.com/tukaani-project/xz/commit/f3b5688159c60495f48db3942a36509671dfce89 (v5.8.4)
 CVE-2026-5087 (PAGI::Middleware::Session::Store::Cookie versions through 0.001003 for ...)
 	NOT-FOR-US: PAGI::Middleware::Session::Store::Cookie Perl module
 CVE-2024-14031 (Sereal::Encoder versions from 4.000 through 4.009_002 for Perl embeds  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/86f97a07711f157c334cd53543b9b04e680d7e4d...b1766e7ead8af7180c35c8f6e25737074f5ebec5

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/86f97a07711f157c334cd53543b9b04e680d7e4d...b1766e7ead8af7180c35c8f6e25737074f5ebec5
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261006/822aa8f2/attachment.htm>