[Git][security-tracker-team/security-tracker][master] Update status for some golang-gvisor-gvisor issues

Fri Oct 9 20:40:10 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
177d007c by Salvatore Bonaccorso at 2026-10-09T21:39:39+02:00
Update status for some golang-gvisor-gvisor issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -15590,7 +15590,8 @@ CVE-2026-96883 (pgcollection is an open source extension to PostgreSQL. A type c
 CVE-2026-96874 (Improper neutralization of input during web page generation ('cross-si ...)
 	NOT-FOR-US: X-SpringBoot
 CVE-2026-96812 (Improper Exposure of Resource to Wrong Sphere in the host file helper  ...)
-	NOT-FOR-US: Google gVisor
+	- golang-gvisor-gvisor <unfixed>
+	NOTE: Fixed by: https://github.com/google/gvisor/commit/573a9e73cf844f9196cbdf776d6a98836b5c0f5c (release-20260824.0)
 CVE-2026-96766 (The GeoDirectory \u2013 WP Business Directory Plugin and Classified Li ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-96752 (The Zero Spam for WordPress plugin for WordPress is vulnerable to Stor ...)
@@ -336080,11 +336081,17 @@ CVE-2024-10847 (The Storely theme for WordPress is vulnerable to Stored Cross-Si
 CVE-2024-10604 (Vulnerabilities in the algorithms used by Fuchsia to populate network  ...)
 	NOT-FOR-US: Fuchsia
 CVE-2024-10603 (Weaknesses in the generation of TCP/UDP source ports and some other he ...)
-	NOT-FOR-US: gVisor
+	- golang-gvisor-gvisor 0.0~20240729.0-1
+	NOTE: Fixed by: https://github.com/google/gvisor/commit/83f75082e5b03fafca9201d9d9939028f712b0b2 (release-20231030.0)
+	NOTE: Fixed by: https://github.com/google/gvisor/commit/cbdb2c61b1f753834cedf2ebe68cbc335dadca52 (release-20231113.0)
+	NOTE: Fixed by: https://github.com/google/gvisor/commit/5d2bf2546805afa09a6f6d9b23ec267823e32205 (release-20231113.0)
 CVE-2024-10591 (The MWB HubSpot for WooCommerce \u2013 CRM, Abandoned Cart, Email Mark ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2024-10026 (A weak hashing algorithm and small sizes of seeds/secrets in Google's  ...)
-	NOT-FOR-US: gVisor
+	- golang-gvisor-gvisor 0.0~20240729.0-1
+	NOTE: Fixed by: https://github.com/google/gvisor/commit/f956b5ac17ae1f60a4d21999b59ba18c55f86d56 (release-20231204.0)
+	NOTE: Fixed by: https://github.com/google/gvisor/commit/e54bfde79278cafadedbf73c68ee10cb5982f2af (release-20231204.0)
+	NOTE: Fixed by: https://github.com/google/gvisor/commit/83f75082e5b03fafca9201d9d9939028f712b0b2 (release-20231030.0)
 CVE-2025-24884 (kube-audit-rest is a simple logger of mutation/creation requests to th ...)
 	NOT-FOR-US: kube-audit-rest
 CVE-2025-24795 (The Snowflake Connector for Python provides an interface for developin ...)
@@ -795191,7 +795198,8 @@ CVE-2018-20169 (An issue was discovered in the Linux kernel before 4.19.9. The U
 	[stretch] - linux 4.9.161-1
 	NOTE: https://git.kernel.org/linus/704620afc70cf47abb9d6a1a57f3825d2bca49cf
 CVE-2018-20168 (Google gVisor before 2018-08-22 reuses a pagetable in a different leve ...)
-	NOT-FOR-US: gVisor
+	- golang-gvisor-gvisor <not-affected> (Fixed before initial upload to Debian)
+	NOTE: https://project-zero.issues.chromium.org/issues/42450740
 CVE-2018-20166 (A file-upload vulnerability exists in Rukovoditel 2.3.1. index.php?mod ...)
 	NOT-FOR-US: Rukovoditel
 CVE-2017-18355 (Installed packages are exposed by node_modules in Rendertron 1.0.0, al ...)
@@ -804392,7 +804400,8 @@ CVE-2018-19335 (Google Monorail before 2018-06-07 has a Cross-Site Search (XS-Se
 CVE-2018-19334 (Google Monorail before 2018-05-04 has a Cross-Site Search (XS-Search)  ...)
 	NOT-FOR-US: Google Monorail
 CVE-2018-19333 (pkg/sentry/kernel/shm/shm.go in Google gVisor before 2018-11-01 allows ...)
-	NOT-FOR-US: gVisor
+	- golang-gvisor-gvisor <not-affected> (Fixed before initial upload to Debian)
+	NOTE: Fixed by: https://github.com/google/gvisor/commit/0e277a39c8b6f905e289b75e8ad0594e6b3562ca (release-20190304.1)
 CVE-2018-19332 (An issue was discovered in S-CMS v1.5. There is a CSRF vulnerability t ...)
 	NOT-FOR-US: S-CMS
 CVE-2018-19331 (An issue was discovered in S-CMS v1.5. There is a SQL injection vulner ...)
@@ -812793,7 +812802,9 @@ CVE-2018-16361 (An issue was discovered in BTITeam XBTIT 2.5.4. news.php allows
 CVE-2018-16360
 	RESERVED
 CVE-2018-16359 (Google gVisor before 2018-08-23, within the seccomp sandbox, permits a ...)
-	NOT-FOR-US: gVisor
+	- golang-gvisor-gvisor <not-affected> (Fixed before initial upload to Debian)
+	NOTE: https://project-zero.issues.chromium.org/issues/42450695
+	NOTE: Fixed by: https://github.com/google/gvisor/commit/001a4c2493b13a43d62c7511fb509a959ae4abc2 (release-20190304.1)
 CVE-2018-16358 (A cross-site scripting (XSS) vulnerability in inc/core/class.dc.core.p ...)
 	- dotclear <removed>
 CVE-2018-16357 (An issue was discovered in PbootCMS. There is a SQL injection via the  ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/177d007c1e2946c8467a9f9ed6f461848af60820

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/177d007c1e2946c8467a9f9ed6f461848af60820
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/37589ff7/attachment.htm>
