[Git][security-tracker-team/security-tracker][master] LTS triagging

[Bastien Roucariès (@rouca)]

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker


Commits:
500d48a0 by Bastien Roucariès at 2026-10-07T16:00:12+02:00
LTS triagging

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -6045,6 +6045,7 @@ CVE-2026-102995 (pypdf is a free and open-source pure-python PDF library. Prior
 CVE-2026-102994 (pypdf is a free and open-source pure-python PDF library. Prior to 6.18 ...)
 	- pypdf 6.19.0-1
 	[trixie] - pypdf <no-dsa> (Minor issue)
+	[bookworm] - pypdf <postponed> (Minor issue)
 	- pypdf2 <removed>
 	[bookworm] - pypdf2 <postponed> (Minor issue, DoS)
 	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-5jq2-8x83-x246
@@ -6053,6 +6054,7 @@ CVE-2026-102994 (pypdf is a free and open-source pure-python PDF library. Prior
 CVE-2026-102993 (pypdf is a free and open-source pure-python PDF library. Prior to 6.17 ...)
 	- pypdf 6.19.0-1
 	[trixie] - pypdf <no-dsa> (Minor issue)
+	[bookworm] - pypdf <postponed> (Minor issue)
 	- pypdf2 <removed>
 	[bookworm] - pypdf2 <not-affected> (Page label support introduced in pypdf 3.2.0)
 	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-qv6h-rv94-w285
@@ -9437,6 +9439,7 @@ CVE-2026-98164 (In the Linux kernel, the following vulnerability has been resolv
 CVE-2026-97711 (Serialize JavaScript serializes JavaScript values to a superset of JSO ...)
 	- node-serialize-javascript 7.1.2+~5.0.4-1
 	[trixie] - node-serialize-javascript <no-dsa> (Minor issue)
+	[bookworm] - node-serialize-javascript <postponed> (Minor issue)
 	NOTE: https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-gfhx-hw2g-v5hg
 	NOTE: Fixed by: https://github.com/yahoo/serialize-javascript/commit/2bdbaaff9cb8a4639135eb24cfcd383d3fefb534 (v7.1.2)
 CVE-2026-97395 (Apache Polaris allows an authenticated principal with permission to cr ...)
@@ -9790,6 +9793,7 @@ CVE-2026-102616 (A vulnerability was detected in risesoft-y9 WorkFlow-Engine up
 CVE-2026-102601 (Flysystem is an open source file storage library for PHP. Prior to 3.3 ...)
 	- php-league-flysystem <unfixed> (bug #1149886)
 	[trixie] - php-league-flysystem <no-dsa> (Minor issue)
+	[bookworm] - php-league-flysystem <postponed> (Minor issue)
 	NOTE: https://github.com/thephpleague/flysystem/security/advisories/GHSA-cxf4-7mrp-vvpr
 	NOTE: Fixed by: https://github.com/thephpleague/flysystem/commit/ef4a9a557d769b5d472c403125716706a0d9cc77 (3.35.3)
 CVE-2026-102600 (Socket.IO enables bidirectional and low-latency communication for ever ...)
@@ -10892,6 +10896,7 @@ CVE-2026-101354 (A security flaw has been discovered in FAST FAC1203R 20200116_2
 CVE-2026-101281 (A flaw has been found in Trusted Domain Project OpenDMARC up to 1.4.2. ...)
 	- opendmarc <unfixed> (bug #1149876)
 	[trixie] - opendmarc <no-dsa> (Minor issue)
+	[bookworm] - opendmarc <postponed> (Minor issue)
 	NOTE: https://github.com/trusteddomainproject/OpenDMARC/issues/262
 	NOTE: https://github.com/trusteddomainproject/OpenDMARC/pull/328
 	NOTE: Fixed by: https://github.com/trusteddomainproject/OpenDMARC/commit/a9a87bdedbf886f5f1e7a6ddce465cb4626d337d
@@ -10899,10 +10904,12 @@ CVE-2026-101281 (A flaw has been found in Trusted Domain Project OpenDMARC up to
 CVE-2026-101280 (A vulnerability was detected in Trusted Domain Project OpenDMARC up to ...)
 	- opendmarc <unfixed> (bug #1149876)
 	[trixie] - opendmarc <no-dsa> (Minor issue)
+	[bookworm] - opendmarc <postponed> (Minor issue)
 	NOTE: https://xuyongzhe-vt.github.io/share/opendmarc-multi-record-downgrade.html
 CVE-2026-101279 (A security vulnerability has been detected in Trusted Domain Project O ...)
 	- opendmarc <unfixed> (bug #1149876)
 	[trixie] - opendmarc <no-dsa> (Minor issue)
+	[bookworm] - opendmarc <postponed> (Minor issue)
 	NOTE: https://xuyongzhe-vt.github.io/share/dmarc-pct-integer-handling.html
 CVE-2026-101278 (A weakness has been identified in Trusted Domain Project OpenDMARC up  ...)
 	- opendmarc <unfixed> (bug #1149876)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/500d48a0ad41b0e1177fb79be5d24b1b221d4dd6

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/500d48a0ad41b0e1177fb79be5d24b1b221d4dd6
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/a786a85a/attachment-0001.htm>