[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Oct 7 16:19:39 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
966aa4ba by Salvatore Bonaccorso at 2026-10-07T17:14:23+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -104,7 +104,7 @@ CVE-2026-82211 (The Nexi XPay Build WordPress plugin through 7.6.2 does not veri
CVE-2026-81535 (In wolfSSH through 1.5.0 built with--enable-fwd,DoChannelOpen()insrc/i ...)
- wolfssh <itp> (bug #983449)
CVE-2026-80048 (A flaw was found in `sssd-kcm`. A local user or process able to connec ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479377
CVE-2026-79960 (When a push was authenticated with a deploy key, Gitea recorded the re ...)
NOT-FOR-US: Gitea (used to be packaged in the Debian archive as src:gitea, but never in a stable release)
@@ -321,7 +321,7 @@ CVE-2026-106456 (Backstage is an open framework for building developer portals.
CVE-2026-106455 (Backstage is an open framework for building developer portals. From 0. ...)
NOT-FOR-US: Backstage
CVE-2026-106454 (Twisted is an event-based framework for internet applications, support ...)
- - twisted <unfixed>
+ - twisted <unfixed> (bug #1150248)
NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-8pqf-f4m5-798g
NOTE: https://github.com/twisted/twisted/pull/12788
NOTE: Fixed by: https://github.com/twisted/twisted/commit/2f8a3c29246f4eb324690e06a9767a11dc4aec9f
@@ -334,15 +334,15 @@ CVE-2026-106452 (yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.1
NOTE: https://github.com/yawkat/lz4-java/security/advisories/GHSA-4v53-57pg-c464
NOTE: Fixed by: https://github.com/yawkat/lz4-java/commit/bb83dd16163cdb71231af06b0a5651881148a634 (v1.11.2)
CVE-2026-106451 (yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1. ...)
- - lz4-java <unfixed>
+ - lz4-java <unfixed> (bug #1150247)
NOTE: https://github.com/yawkat/lz4-java/security/advisories/GHSA-mcr4-qmvw-px4g
NOTE: Fixed by: https://github.com/yawkat/lz4-java/commit/7a48b7f6b8099b9dab6541e4ac2ee0979dc55aa3 (v1.11.4)
CVE-2026-106450 (yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, ne ...)
- - lz4-java <unfixed>
+ - lz4-java <unfixed> (bug #1150247)
NOTE: https://github.com/yawkat/lz4-java/security/advisories/GHSA-gm45-99xc-r7wv
NOTE: Fixed by: https://github.com/yawkat/lz4-java/commit/2acc0ec1ead226145c62a817c18c8ed49233a283 (v1.11.4)
CVE-2026-106449 (yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, ne ...)
- - lz4-java <unfixed>
+ - lz4-java <unfixed> (bug #1150247)
NOTE: https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr
NOTE: Fixed by: https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8 (v1.11.4)
CVE-2026-106448 (StableLib is a stable library of useful TypeScript and JavaScript code ...)
@@ -350,37 +350,37 @@ CVE-2026-106448 (StableLib is a stable library of useful TypeScript and JavaScri
CVE-2026-106447 (StableLib is a stable library of useful TypeScript and JavaScript code ...)
NOT-FOR-US: StableLib
CVE-2026-106446 (Handlebars provides the power necessary to let users build semantic te ...)
- - node-handlebars <unfixed>
+ - node-handlebars <unfixed> (bug #1150246)
NOTE: https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj
NOTE: https://github.com/handlebars-lang/handlebars.js/pull/2185
NOTE: Fixed by: https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2 (v4.7.10)
NOTE: CVE exists because of a bypass of CVE-2026-33937
CVE-2026-106445 (Handlebars provides the power necessary to let users build semantic te ...)
- - node-handlebars <unfixed>
+ - node-handlebars <unfixed> (bug #1150246)
NOTE: https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f
NOTE: https://github.com/handlebars-lang/handlebars.js/pull/2185
NOTE: Fixed by: https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa (v4.7.10)
CVE-2026-106444 (Handlebars provides the power necessary to let users build semantic te ...)
- - node-handlebars <unfixed>
+ - node-handlebars <unfixed> (bug #1150246)
NOTE: https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7
NOTE: https://github.com/handlebars-lang/handlebars.js/pull/2185
NOTE: Fixed by: https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725 (v4.7.10)
CVE-2026-106063 (A heap-based buffer overflow was found in GIMP\u2019s DICOM export plu ...)
- - gimp <unfixed>
+ - gimp <unfixed> (bug #1150243)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2546668
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/3030
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/7e7166e8004bc92ed807c7d845db449ccd4651f0 (gimp-3-2 branch)
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/3e79c2aa019702d51f8dd77f7b1a1f0c3c2c98f3 (gimp-3-2 branch)
CVE-2026-106062 (A heap-based buffer overflow was found in GIMP\u2019s DirectDraw Surfa ...)
- - gimp <unfixed>
+ - gimp <unfixed> (bug #1150242)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2546654
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/merge_requests/3045
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/d528365f7644099d8e07f999660ed0aa71210d85
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/01e6663942adebb347d11ffc7d94ac23da01ff62
CVE-2026-106061 (A flaw was found in GIMP\u2019s X cursor (XMC) thumbnail loader. When ...)
- - gimp <unfixed>
+ - gimp <unfixed> (bug #1150241)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2546640
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16801
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gimp/-/commit/f75c99b283b5b0f476289c4ce89f7b7164032736 (gimp-3-2 branch)
@@ -407,7 +407,7 @@ CVE-2026-105244 (Improper Encoding or Escaping of Output vulnerability in the Re
NOTE: https://lists.apache.org/thread/q7649hhdodthoqw8jsjgtnb4m8qfy6d6
TODO: check, might not affect our old version and upstream claims 1.2.12 onwards
CVE-2026-105243 (Insufficient Logging vulnerability in the EventLogAppender of Apache l ...)
- - log4net <unfixed>
+ - log4net <unfixed> (bug #1150239)
NOTE: https://github.com/apache/logging-log4net/pull/315
NOTE: Fixed by: https://github.com/apache/logging-log4net/commit/28fbfb25678c48a8cc5bc9b94ead0dddfc39ffed (rc/3.5.0-rc1)
NOTE: https://lists.apache.org/thread/jr6fj5skv1vnjbc9jmt8bp151p8ow1rp
@@ -418,17 +418,17 @@ CVE-2026-105242 (Improper Handling of Exceptional Conditions vulnerability in th
NOTE: https://lists.apache.org/thread/zg6dbqm4ztm7j3c21nfsqj0yxm5yrpdx
TODO: check, might not affect our old version, upstream claims 12.11 onwards
CVE-2026-105241 (Improper Handling of Unicode Encoding vulnerability in the SmtpPickupD ...)
- - log4net <unfixed>
+ - log4net <unfixed> (bug #1150239)
NOTE: https://github.com/apache/logging-log4net/pull/315
NOTE: Fixed by: https://github.com/apache/logging-log4net/commit/4d2e10f0908199604b4326f9df6d0b43b871e333 (rc/3.5.0-rc1)
NOTE: https://lists.apache.org/thread/hg8dgh3oy8bp3dhb8nsygk9kw2o401ws
CVE-2026-105240 (Improper Neutralization of Null Byte or NUL Character vulnerability in ...)
- - log4net <unfixed>
+ - log4net <unfixed> (bug #1150239)
NOTE: https://github.com/apache/logging-log4net/pull/315
NOTE: Fixed by: https://github.com/apache/logging-log4net/commit/6046fe9d7f353b49fe995361c071ec2eea8f7ef6 (rc/3.5.0-rc1)
NOTE: https://lists.apache.org/thread/gyw2d4ppy82t1vlpdknkfd1nmzp21z17
CVE-2026-105239 (Improper Neutralization of Null Byte or NUL Character vulnerability in ...)
- - log4net <unfixed>
+ - log4net <unfixed> (bug #1150239)
NOTE: https://github.com/apache/logging-log4net/pull/315
NOTE: Fixed by: https://github.com/apache/logging-log4net/commit/dc5855a0720c91590fd7a81d729ea01fdd69e000 (rc/3.5.0-rc1)
NOTE: https://lists.apache.org/thread/9fx1qo5hc0tg8ym0t6p9gt1zpb2qlxpq
@@ -468,16 +468,16 @@ CVE-2026-104050 (The Academy LMS WordPress plugin before 4.0.0 does not verify
CVE-2026-104049 (The Academy LMS WordPress plugin before 4.0.0 does not verify course ...)
NOT-FOR-US: WordPress plugin
CVE-2026-104048 (A flaw was found in SSSD. In trust-enabled identity management environ ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478613
CVE-2026-104047 (A flaw was found in SSSD. When configured to use Microsoft Entra ID, s ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478616
CVE-2026-104046 (A flaw was found in SSSD (System Security Services Daemon). When Ident ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478662
CVE-2026-104045 (A flaw was found in SSSD. A local user can trigger a Denial of Service ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478663
CVE-2026-103870 (A flaw was found in pulp-rpm when it publishes a distribution tree. Ad ...)
NOT-FOR-US: Pulp (Red Hat)
@@ -694,7 +694,7 @@ CVE-2026-94206 (Use of Password Hash With Insufficient Computational Effort vuln
CVE-2026-91140 (An OS command injection vulnerability in the shell-based temporary-fil ...)
NOT-FOR-US: Progress Software
CVE-2026-88252 (A flaw was found in sssd. A local user can cause a Denial of Service ( ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479240
CVE-2026-86362 (Dell System Update, versions prior to 2.3.0.0, contains an Improper Ac ...)
NOT-FOR-US: Dell / EMC
@@ -987,7 +987,7 @@ CVE-2026-106512 (The CakeResponse::download() method in lib/Cake/Network/CakeRes
CVE-2026-106511 (MultiversX's multisig-improved (repository: mx-multisig-and-modules) r ...)
NOT-FOR-US: MultiversX
CVE-2026-106443 (WeasyPrint helps web developers to create PDF documents. Prior to 70.0 ...)
- - weasyprint <unfixed>
+ - weasyprint <unfixed> (bug #1150245)
NOTE: https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-r543-q48m-4c9j
NOTE: Fixed by: https://github.com/Kozea/WeasyPrint/commit/39cd37ce1610bd890388e26591c569db1cbab542 (v70.0)
CVE-2026-106442 (Hydra is a framework for elegantly configuring complex applications. F ...)
@@ -1495,17 +1495,17 @@ CVE-2026-106180 (Observable discrepancy in Animation in Google Chrome prior to 1
CVE-2026-106179 (UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0 ...)
- chromium <unfixed>
CVE-2026-106123 (The RabbitMQ Java client library allows Java and JVM-based application ...)
- - rabbitmq-java-client <unfixed>
+ - rabbitmq-java-client <unfixed> (bug #1150244)
NOTE: https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-h6w7-qmcm-q6xr
NOTE: https://github.com/rabbitmq/rabbitmq-java-client/pull/2052
NOTE: Fixed by: https://github.com/rabbitmq/rabbitmq-java-client/commit/daca1875cdb8b8c0acce78f71103b21a05478446 (v5.35.0)
CVE-2026-106122 (The RabbitMQ Java client library allows Java and JVM-based application ...)
- - rabbitmq-java-client <unfixed>
+ - rabbitmq-java-client <unfixed> (bug #1150244)
NOTE: https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-7822-rcf6-97fx
NOTE: https://github.com/rabbitmq/rabbitmq-java-client/pull/2065
NOTE: Fixed by: https://github.com/rabbitmq/rabbitmq-java-client/commit/b8bd750fa8c90690e859b18d6343b34421309020 (v5.36.0)
CVE-2026-106121 (The RabbitMQ Java client library allows Java and JVM-based application ...)
- - rabbitmq-java-client <unfixed>
+ - rabbitmq-java-client <unfixed> (bug #1150244)
NOTE: https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-cqgh-8p3p-mx4m
NOTE: https://github.com/rabbitmq/rabbitmq-java-client/pull/2100
NOTE: Fixed by: https://github.com/rabbitmq/rabbitmq-java-client/commit/25fad817291feff3195c32620117d295598f8b41 (v5.37.0)
@@ -1636,13 +1636,13 @@ CVE-2026-105845 (Payload is a free and open source headless content management s
CVE-2026-105844 (Payload is a free and open source headless content management system. ...)
NOT-FOR-US: Payload CMS
CVE-2026-105842 (lrzsz before 0.13.0 contains a heap-based buffer overflow vulnerabilit ...)
- - lrzsz <unfixed>
+ - lrzsz <unfixed> (bug #1150240)
NOTE: https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html
CVE-2026-105841 (lrzsz before 0.13.0 contains an OS command injection vulnerability in ...)
- - lrzsz <unfixed>
+ - lrzsz <unfixed> (bug #1150240)
NOTE: https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html
CVE-2026-105840 (lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz ...)
- - lrzsz <unfixed>
+ - lrzsz <unfixed> (bug #1150240)
NOTE: https://ohse.de/uwe/software/lrzsz/NEWS-0.13.0.html
CVE-2026-105839 (libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer ...)
- libmikmod 3.3.14-1
@@ -2831,52 +2831,52 @@ CVE-2026-105072 (Unauthenticated Broken Access Control in FluentBooking Pro < 2.
CVE-2026-104852 (GraphQL Tools provides utilities for building, stitching, and mocking ...)
NOT-FOR-US: GraphQL Tools
CVE-2026-104044 (A flaw was found in sssd. A local attacker can trigger a Denial of Ser ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478664
CVE-2026-104043 (A flaw was found in SSSD. A local attacker with access to the Name Ser ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478852
CVE-2026-104042 (A flaw was found in sssd. A local attacker can cause a Denial of Servi ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478862
CVE-2026-104041 (A flaw was found in SSSD. An unprivileged local user can repeatedly re ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478864
CVE-2026-104040 (A flaw was found in SSSD. When configured with the Entra ID identity p ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478915
CVE-2026-104039 (A flaw was found in SSSD. A local user can cause a denial of service ( ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478956
CVE-2026-104038 (A flaw was found in sssd. A remote attacker can cause a denial of serv ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478980
CVE-2026-104037 (A flaw was found in SSSD. A local attacker can exploit this issue by s ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479030
CVE-2026-104036 (A flaw was found in SSSD's NFS idmap plugin. When retrieving cached us ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479057
CVE-2026-104035 (A flaw was found in SSSD. An issue in the Kerberos Credential Manager ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479107
CVE-2026-104034 (A flaw was found in SSSD. A use-after-free vulnerability exists in the ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479178
CVE-2026-104033 (A flaw was found in SSSD. When configured to enforce account expiratio ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479271
CVE-2026-104032 (A flaw was found in SSSD. An unprivileged local user can repeatedly re ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479381
CVE-2026-104031 (A flaw was found in SSSD. In configurations where the autofs responder ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479418
CVE-2026-104030 (A flaw was found in sssd. This vulnerability allows a local user to ca ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479429
CVE-2026-104029 (A flaw was found in SSSD. A local attacker can exploit this vulnerabil ...)
- - sssd <unfixed>
+ - sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479444
CVE-2026-103546 (In MongoDB Controllers for Kubernetes, insufficient validation of Ops ...)
NOT-FOR-US: MongoDB Controllers for Kubernetes
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/966aa4ba64e06c60630a6fb273ca68364619d8d6
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/966aa4ba64e06c60630a6fb273ca68364619d8d6
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261007/ad2fad20/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list