[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues

Salvatore Bonaccorso (@carnil) carnil at debian.org
Fri Oct 9 21:31:51 BST 2026 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b6ee9e70 by Salvatore Bonaccorso at 2026-10-09T22:31:24+02:00
Add Debian bug references for various issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -985,7 +985,7 @@ CVE-2026-107780 (Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ea
 CVE-2026-107779 (Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 ...)
 	NOT-FOR-US: Dromara Skyeye
 CVE-2026-107778 (MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereferen ...)
-	- krb5 <unfixed>
+	- krb5 <unfixed> (bug #1150461)
 	NOTE: https://github.com/krb5/krb5/pull/1511
 	NOTE: Fixed by: https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08 (master)
 	NOTE: Fixed by: https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a (krb5-1.22 branch)
@@ -1051,7 +1051,7 @@ CVE-2026-107714 (The Mechanize library is used for automating interaction with w
 CVE-2026-107709 (A path traversal vulnerability exists in Bower decompress-zip through  ...)
 	NOT-FOR-US: Bower decompress-zip
 CVE-2026-107708 (MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerabil ...)
-	- krb5 <unfixed>
+	- krb5 <unfixed> (bug #1150461)
 	NOTE: https://github.com/krb5/krb5/pull/1510
 	NOTE: Fixed by: https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7 (master)
 	NOTE: Fixed by: https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d (krb5-1.22 branch)
@@ -1127,7 +1127,7 @@ CVE-2026-107660 (FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper c
 	NOTE: Fixed by: https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f (n8.1.3)
 	NOTE: mbedtls not enabled in Debian builds
 CVE-2026-107651 (A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow e ...)
-	- eog <unfixed>
+	- eog <unfixed> (bug #1150455)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547986
 	NOTE: https://gitlab.gnome.org/GNOME/eog/-/issues/342
 CVE-2026-107640 (Integrics Enswitch 3.13 through 4.4 contains an authentication bypass  ...)
@@ -1141,10 +1141,10 @@ CVE-2026-107637 (pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an im
 CVE-2026-107636 (pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment va ...)
 	NOT-FOR-US: pH7Builder (pH7 Social Dating CMS)
 CVE-2026-107635 (Dislocker through 0.7.3 contains an integer underflow vulnerability in ...)
-	- dislocker <unfixed>
+	- dislocker <unfixed> (bug #1150456)
 	NOTE: Fixed by: https://github.com/Aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581
 CVE-2026-107634 (Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerabili ...)
-	- dislocker <unfixed>
+	- dislocker <unfixed> (bug #1150456)
 	NOTE: Fixed by: https://github.com/Aorimn/dislocker/commit/9158e9e41dd669b360cbc53cc18ccae729b67b48
 CVE-2026-107623 (A flaw was found in the OIDC Dynamic Client Registration (DCR) compone ...)
 	- keycloak <itp> (bug #1088287)
@@ -1283,11 +1283,11 @@ CVE-2026-107333 (Malcolm's nginx based reverse proxy contains a URL path normali
 CVE-2026-107332 (Insecure file permissions in the CodeCatalyst connection handler in AW ...)
 	NOT-FOR-US: Amazon
 CVE-2026-107325 (Improper validation of a BSON array length in the MongoDB Go Driver ca ...)
-	- golang-mongodb-mongo-driver <unfixed>
+	- golang-mongodb-mongo-driver <unfixed> (bug #1150459)
 	NOTE: https://jira.mongodb.org/browse/GODRIVER-4136
 	NOTE: Fixed by: https://github.com/mongodb/mongo-go-driver/commit/a0973940ec32f31e406ca4a5d7db03288bb628dc (v2.9.2)
 CVE-2026-107324 (An integer overflow in BSON value-length handling in the MongoDB Go Dr ...)
-	- golang-mongodb-mongo-driver <unfixed>
+	- golang-mongodb-mongo-driver <unfixed> (bug #1150459)
 	NOTE: https://jira.mongodb.org/browse/GODRIVER-4102
 	NOTE: Fixed by: https://github.com/mongodb/mongo-go-driver/commit/6e5eff3ea7bc5b6743f9fcec6bb8d523b0c98bbc (v2.9.2)
 CVE-2026-107322 (An incomplete list of disallowed inputs in Amazon Agent Plugins for AW ...)
@@ -1355,7 +1355,7 @@ CVE-2026-106436 (The BSON encoder in the MongoDB PHP Driver does not check some
 	NOTE: https://jira.mongodb.org/browse/PHPC-2739
 	NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/79036dd7a4c946cfef2d0105f8102f26d685b260 (2.5.4, 2.1.11, 1.21.11)
 CVE-2026-106435 (The MongoDB Python Driver's binary accelerator can read outside a buff ...)
-	- pymongo <unfixed>
+	- pymongo <unfixed> (bug #1150462)
 	[trixie] - pymongo <no-dsa> (Minor issue)
 	NOTE: https://jira.mongodb.org/browse/PYTHON-6110
 	NOTE: Fixed by: https://github.com/mongodb/mongo-python-driver/commit/bb8d4e195275e75bd94ebeffb53cc747d357fcf4 (4.18.3)
@@ -2352,19 +2352,19 @@ CVE-2026-107175 (MISP contains a defect in its event save workflow that prevents
 CVE-2026-107174 (A flaw was found in source-to-image. When unpacking archive files, the ...)
 	NOT-FOR-US: source-to-image in OpenShift
 CVE-2026-107170 (A flaw was found in m17n-lib. A partial failure during library initial ...)
-	- m17n-lib <unfixed>
+	- m17n-lib <unfixed> (bug #1150458)
 	[trixie] - m17n-lib <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547411
 CVE-2026-107169 (A flaw was found in m17n-lib. An attacker could provide specially craf ...)
-	- m17n-lib <unfixed>
+	- m17n-lib <unfixed> (bug #1150458)
 	[trixie] - m17n-lib <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547410
 CVE-2026-107168 (A flaw was found in m17n-lib. By providing crafted input containing an ...)
-	- m17n-lib <unfixed>
+	- m17n-lib <unfixed> (bug #1150458)
 	[trixie] - m17n-lib <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547409
 CVE-2026-107167 (A flaw was found in m17n-lib. A user providing specially crafted text  ...)
-	- m17n-lib <unfixed>
+	- m17n-lib <unfixed> (bug #1150458)
 	[trixie] - m17n-lib <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547408
 CVE-2026-107166 (A weakness has been identified in Open5GS up to 2.7.7. This vulnerabil ...)
@@ -2372,7 +2372,7 @@ CVE-2026-107166 (A weakness has been identified in Open5GS up to 2.7.7. This vul
 CVE-2026-107162 (Express Gateway through 1.16.11 contains an authentication bypass vuln ...)
 	NOT-FOR-US: Express Gateway
 CVE-2026-107159 (MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero ...)
-	- miniupnpd <unfixed>
+	- miniupnpd <unfixed> (bug #1150457)
 	NOTE: Fixed by: https://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a
 CVE-2026-107151 (Missing authentication has been found in remote-execution task updates ...)
 	NOT-FOR-US: rubygem-smart_proxy_dynflow
@@ -3368,17 +3368,17 @@ CVE-2026-77178 (Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause
 CVE-2026-76105 (Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an ...)
 	NOT-FOR-US: Dell / EMC
 CVE-2026-75820 (GNU Aspell contains an integer truncation vulnerability in the Writabl ...)
-	- aspell <unfixed>
+	- aspell <unfixed> (bug #1150460)
 	[trixie] - aspell <no-dsa> (Minor issue)
 	NOTE: https://cert.pl/en/posts/2026/10/CVE-2026-75818
 	NOTE: Fixed by: https://github.com/GNUAspell/aspell/commit/782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d
 CVE-2026-75819 (GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDic ...)
-	- aspell <unfixed>
+	- aspell <unfixed> (bug #1150460)
 	[trixie] - aspell <no-dsa> (Minor issue)
 	NOTE: https://cert.pl/en/posts/2026/10/CVE-2026-75818
 	NOTE: Fixed by: https://github.com/GNUAspell/aspell/commit/941953b25031bc9104e83f58e138a664b8dedc3f
 CVE-2026-75818 (GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerabil ...)
-	- aspell <unfixed>
+	- aspell <unfixed> (bug #1150460)
 	[trixie] - aspell <no-dsa> (Minor issue)
 	NOTE: https://cert.pl/en/posts/2026/10/CVE-2026-75818
 	NOTE: Fixed by: https://github.com/GNUAspell/aspell/commit/15b188437f9e0192d4ac4472ad66a4e2f62a782f



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6ee9e706f1a6a9fe587534cb8e9acdce7a55086

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6ee9e706f1a6a9fe587534cb8e9acdce7a55086
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261009/f40d367c/attachment.htm>

More information about the debian-security-tracker-commits mailing list