[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Oct 9 14:14:50 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
bd36d426 by Moritz Muehlenhoff at 2026-10-09T15:14:38+02:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -516,39 +516,48 @@ CVE-2026-107698 (FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-si
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/b05562b9b399057b6537fae337d0eeabcff6ef5c (n5.1.9)
CVE-2026-107697 (FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS ...)
- ffmpeg 7:9.0.2-1
+ [trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/23602df9cd1b485c45ba6f533d3b85569de3f323 (master)
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/01044d04536eec6e2f5f48ef404cf45d15feb461 (n9.0)
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/191715f0232cee64402c3e7733f28ff4061224b6 (n8.1.3)
CVE-2026-107696 (FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rts ...)
- ffmpeg <unfixed>
+ [trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24902
CVE-2026-107695 (FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS ...)
- ffmpeg 7:9.0.2-1
+ [trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/c364ab176f722bdabc886845e770c9eacbc1e3e5 (master)
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0e6eef35517af086419c5157980e926a81070c2a (n9.0)
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/a4ddaba8bb7811b1a3afaad59fe6555e720d4754 (n8.1.3)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23618
CVE-2026-107678 (FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_e ...)
- ffmpeg <unfixed>
+ [trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24593
CVE-2026-107677 (FFmpeg through 9.0.2 contains a denial of service vulnerability in the ...)
- ffmpeg <unfixed>
+ [trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24592
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/ed27bfcbbbc0872c0195eaf4dd2c0c93b9f1778e (master)
CVE-2026-107676 (FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulne ...)
- ffmpeg <unfixed>
+ [trixie] - ffmpeg <postponed> (Wait until fixed in 7.1.x upstream branch)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24590
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2c2f6e96e31795ae95a8f8323a493ffbc493111f (master)
CVE-2026-107675 (FFmpeg through 9.0.2 contains a missing host key verification vulnerab ...)
- ffmpeg <unfixed>
+ [trixie] - ffmpeg <ignored> (Minor issue and breaking change, won't be backported to release branches)
+ [bookworm] - ffmpeg <ignored> (Minor issue and breaking change, won't be backported to release branches)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24384
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/2b822b7fb6ed195546bc9fd9bdb794e98222bdce (master)
CVE-2026-107660 (FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certific ...)
- - ffmpeg 7:9.0.2-1
+ - ffmpeg 7:9.0.2-1 (unimportant)
NOTE: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/24383
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/57a2e704b4a6eda5d061b45aacde6b19c026bfc0 (master)
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/d377212904a19fc740d721cbda0ba58fa3805a29 (n9.0.2)
NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f (n8.1.3)
+ NOTE: mbedtls not enabled in Debian builds
CVE-2026-107651 (A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow e ...)
- eog <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547986
@@ -2000,9 +2009,11 @@ CVE-2025-64391 (This vulnerability in Veeam Agent for Microsoft Windows allows a
NOT-FOR-US: Veeam
CVE-2026-92415 (\u2014 Use of Externally-Controlled Input to Select Classes or Code vu ...)
- jackrabbit <unfixed> (bug #1150343)
+ [trixie] - jackrabbit <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/07/28
CVE-2026-92414 (: Session Fixation / Session Reuse across Users vulnerability in Apach ...)
- jackrabbit <unfixed> (bug #1150343)
+ [trixie] - jackrabbit <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/07/27
CVE-2026-98374 (In the Linux kernel, the following vulnerability has been resolved: t ...)
- linux 7.2.9-1
@@ -21123,7 +21134,8 @@ CVE-2026-95619 (A flaw was found in libstdc++. An integer overflow can occur whe
[trixie] - gcc-14 <no-dsa> (Minor issue)
- gcc-12 <unfixed>
[trixie] - gcc-12 <no-dsa> (Minor issue)
- NOTE: https://github.com/gcc-mirror/gcc/commit/59d235ffa5a69231eb42e5290d52dc8c90d28b7a
+ NOTE: https://github.com/gcc-mirror/gcc/commit/59d235ffa5a69231eb42e5290d52dc8c90d28b7a (master)
+ NOTE: https://github.com/gcc-mirror/gcc/commit/200183d4ab5d57575f3dfebc6af3baf649910b9e (releases/gcc-14)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2537811
CVE-2026-95511
REJECTED
=====================================
data/dsa-needed.txt
=====================================
@@ -100,7 +100,9 @@ modsecurity
--
modsecurity-apache
--
-nagios4
+mutt (jmm)
+--
+nagios4 (jmm)
Maintainer provided an update for review in <3f58c7ff-9d20-4a71-b0aa-76671a492e17 at stuart.id.au>
--
nats-server
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bd36d42621b5fad95773b4561704b2b23257167c
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bd36d42621b5fad95773b4561704b2b23257167c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/5ef509d7/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list