[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Oct 10 10:57:07 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
fbdd5f02 by Salvatore Bonaccorso at 2026-10-10T11:56:45+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -45,7 +45,7 @@ CVE-2026-93775 (The Podlove Podcast Publisher plugin for WordPress is vulnerable
CVE-2026-92975 (The Groundhogg \u2014 CRM, Newsletters, and Marketing Automation plugi ...)
NOT-FOR-US: WordPress plugin
CVE-2026-92705 (Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3. ...)
- - aegisub <unfixed>
+ - aegisub <unfixed> (bug #1150511)
NOTE: https://github.com/TypesettingTools/Aegisub/security/advisories/GHSA-67hq-5vgg-6f23
NOTE: Fixed by: https://github.com/TypesettingTools/Aegisub/commit/0a3073d59f10432eeebea65018b02ef4d0a87fff (v3.5.0-beta)
NOTE: Fixed by: https://github.com/TypesettingTools/Aegisub/commit/b5bf23979e7453f7b1cc8ffeb82b3cc2d2ca75e6 (v3.5.0-beta)
@@ -327,7 +327,7 @@ CVE-2026-96328 (Improper Neutralization of Special Elements used in an SQL Comma
CVE-2026-96327 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-95702 (Use-after-free vulnerability in VFS in Google gVisor prior to release ...)
- - golang-gvisor-gvisor <unfixed>
+ - golang-gvisor-gvisor <unfixed> (bug #1150510)
NOTE: Fixed by: https://github.com/google/gvisor/commit/90bc4fc36fe442257a06ba15df00371561c183ed (release-20260831.0)
NOTE: Fixed by: https://github.com/google/gvisor/commit/25c75149bc0eeaa6a3a49b9bbe3473588b2af6df (release-20260824.0)
NOTE: Fixed by: https://github.com/google/gvisor/commit/e4efb89c787ef15b09e68d561f1303380e1d5a77 (release-20260831.0)
@@ -599,13 +599,13 @@ CVE-2026-108108 (PHPNuxBill through 2025.3.20 contains an authentication bypass
CVE-2026-108107 (PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection ...)
NOT-FOR-US: PHPNuxBill
CVE-2026-108106 (Xerial snappy-java before 1.1.10.9 contains an unbounded memory alloca ...)
- - snappy-java <unfixed>
+ - snappy-java <unfixed> (bug #1150499)
NOTE: https://github.com/xerial/snappy-java/security/advisories/GHSA-q233-g92q-qxp6
NOTE: Fixed by: https://github.com/xerial/snappy-java/commit/943c6043a292568575e8347af4507d015e802c75 (v1.1.10.9)
CVE-2026-108105 (Open5GS through 2.8.0 contains a reachable assertion vulnerability in ...)
- open5gs <itp> (bug #1094791)
CVE-2026-108104 (Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double rel ...)
- - snappy-java <unfixed>
+ - snappy-java <unfixed> (bug #1150498)
NOTE: https://github.com/xerial/snappy-java/security/advisories/GHSA-c73m-r934-8qvg
NOTE: Fixed by: https://github.com/xerial/snappy-java/commit/139a53090a6662298924fd75d21f4769b4a219ea (v1.1.10.10)
CVE-2026-108103 (Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability ...)
@@ -619,11 +619,11 @@ CVE-2026-108100 (HortusFox (hortusfox-web) before 6.2 contains an SQL injection
CVE-2026-108096 (Improper authorization in the query resolvers generated by @aws-amplif ...)
NOT-FOR-US: Amazon
CVE-2026-108093 (A flaw was found in GIMP. The XCF loader processes image-simulation-in ...)
- - gimp <unfixed>
+ - gimp <unfixed> (bug #1150497)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2548607
TODO: research upstream information, Red Hat bugzilla is not open at 2026-10-09
CVE-2026-108063 (A flaw was found in libhangul. When parsing Hanja dictionary files, th ...)
- - libhangul <unfixed>
+ - libhangul <unfixed> (bug #1150512)
NOTE: https://github.com/libhangul/libhangul/issues/106
CVE-2026-108039 (By default, StaxUtils placed no limit on the total number of elements ...)
NOT-FOR-US: Apache software not packaged in Debian
@@ -632,7 +632,7 @@ CVE-2026-107938 (In Apache CXF, the Netty-based HTTP client transport (cxf-rt-tr
CVE-2026-107937 (In Apache CXF, the parser for multipart/MTOM attachment part headers d ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-107935 (A path traversal vulnerability was found in gvproxy, the network forwa ...)
- - golang-github-containers-gvisor-tap-vsocks <unfixed>
+ - golang-github-containers-gvisor-tap-vsocks <unfixed> (bug #1150513)
NOTE: https://github.com/containers/gvisor-tap-vsock/pull/718
CVE-2026-107841 (pacioli provides least-privilege governance and a governed agent broke ...)
NOT-FOR-US: pacioli for ERPNext
@@ -789,7 +789,7 @@ CVE-2026-103220 (The Affinity by Canva application before 3.3.1 (October 2026 re
CVE-2026-102916 (A reachable assertion in the illumos bhyve instruction emulator allows ...)
NOT-FOR-US: illumos
CVE-2026-102554 (Allocation of resources without limits or throttling (CWE-770) during ...)
- - guava-libraries <unfixed>
+ - guava-libraries <unfixed> (bug #1150495)
NOTE: https://github.com/google/guava/security/advisories/GHSA-xxph-c9ww-hj94
NOTE: Fixed by: https://github.com/google/guava/commit/b931fe9d6d5cf00bc55714ad3308d086f71850fe (master)
NOTE: Fixed by: https://github.com/google/guava/commit/a0d0c36432c4cc7aa4b5063bab9f20d3d18fe9fc (v33.7.2)
@@ -1056,31 +1056,31 @@ CVE-2026-50054 (An authorization flaw in Zimbra Collaboration Suite\u2019s Grant
CVE-2026-4894 (A vulnerability has been identified regarding insufficient validation ...)
NOT-FOR-US: Frappe
CVE-2026-44038 (A global out-of-bounds read in the Huffman decoder of the bundled IJG ...)
- - dcmtk <unfixed>
+ - dcmtk <unfixed> (bug #1150506)
NOTE: https://support.dcmtk.org/redmine/issues/1221
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5
CVE-2026-44037 (Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), D ...)
- - dcmtk <unfixed>
+ - dcmtk <unfixed> (bug #1150505)
NOTE: https://support.dcmtk.org/redmine/issues/1225
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7
CVE-2026-44036 (Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet( ...)
- - dcmtk <unfixed>
+ - dcmtk <unfixed> (bug #1150504)
NOTE: https://support.dcmtk.org/redmine/issues/1224
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/87f256d73e30656a822bf7d76d1cf1d9bb693954
CVE-2026-44035 (Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/l ...)
- - dcmtk <unfixed>
+ - dcmtk <unfixed> (bug #1150503)
NOTE: https://support.dcmtk.org/redmine/issues/1215
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f
CVE-2026-44034 (A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() i ...)
- - dcmtk <unfixed>
+ - dcmtk <unfixed> (bug #1150502)
NOTE: https://support.dcmtk.org/redmine/issues/1213
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/45469f3c30037e9c7159290e4bb74cd7b3b9ef1d
CVE-2026-44033 (Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::empt ...)
- - dcmtk <unfixed>
+ - dcmtk <unfixed> (bug #1150501)
NOTE: https://support.dcmtk.org/redmine/issues/1214
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941
CVE-2026-44031 (Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read ...)
- - dcmtk <unfixed>
+ - dcmtk <unfixed> (bug #1150500)
NOTE: https://support.dcmtk.org/redmine/issues/1191
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f
CVE-2026-42698 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
@@ -1344,7 +1344,7 @@ CVE-2026-107707 (Intego Antivirus for Windows through 3.0.0.1 contains a link fo
CVE-2026-107706 (Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vul ...)
NOT-FOR-US: Dolibarr
CVE-2026-107705 (Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow ...)
- - poppler <unfixed>
+ - poppler <unfixed> (bug #1150515)
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1814
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/merge_requests/2398
CVE-2026-107704 (The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS comman ...)
@@ -1637,7 +1637,7 @@ CVE-2026-106437 (The BSON buffer-reservation API in the MongoDB C Driver can rec
NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/6c593a59a9dce87e42298b85779ca02a9357dd74 (2.5.6)
NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/b7f1f5742351741c068020196fd88f196551aad2 (1.30.13)
CVE-2026-106436 (The BSON encoder in the MongoDB PHP Driver does not check some return ...)
- - php-mongodb <unfixed>
+ - php-mongodb <unfixed> (bug #1150514)
NOTE: https://jira.mongodb.org/browse/PHPC-2739
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/79036dd7a4c946cfef2d0105f8102f26d685b260 (2.5.4, 2.1.11, 1.21.11)
CVE-2026-106435 (The MongoDB Python Driver's binary accelerator can read outside a buff ...)
@@ -1656,7 +1656,7 @@ CVE-2026-106433 (Improper state management in MongoDB libmongocrypt can cause pr
NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/556bcb70b6efecb7f568d824b03469df3a3bc91a (1.20.5)
NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/8bc580ea69eea13a932197221edf72830fbc38a1 (1.20.5)
CVE-2026-106432 (The BSON encoder in the MongoDB PHP Driver converts a string length to ...)
- - php-mongodb <unfixed>
+ - php-mongodb <unfixed> (bug #1150514)
NOTE: https://jira.mongodb.org/browse/PHPC-2741
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/79036dd7a4c946cfef2d0105f8102f26d685b260 (2.5.4, 2.1.11, 1.21.11)
CVE-2026-106431 (An off-by-one error in the BSON bulk document writer in the MongoDB C ...)
@@ -2338,7 +2338,7 @@ CVE-2026-107227 (The AsyncHttpClient (AHC) library allows Java applications to e
CVE-2026-107176 (A flaw was found in the cluster-samples-operator. The RBAC Role coreos ...)
NOT-FOR-US: cluster-samples-operator
CVE-2026-107161 (A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_ ...)
- - cyrus-sasl2 <unfixed>
+ - cyrus-sasl2 <unfixed> (bug #1150516)
NOTE: https://github.com/cyrusimap/cyrus-sasl/issues/889
NOTE: https://github.com/cyrusimap/cyrus-sasl/pull/892
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2460420
@@ -13632,7 +13632,7 @@ CVE-2026-81862 (Apache Airflow's Teradata provider embedded cloud storage creden
CVE-2026-97685 (An authenticated LimeSurvey Community Edition 7.3.0 user allowed to cr ...)
- limesurvey <itp> (bug #472802)
CVE-2026-96760 (Authlib (v1.7.2 and below) contains a signature verification bypass vu ...)
- - python-authlib <unfixed>
+ - python-authlib <unfixed> (bug #1150509)
NOTE: https://kb.cert.org/vuls/id/762428
NOTE: https://github.com/authlib/authlib/issues/940
NOTE: https://github.com/authlib/authlib/pull/938#issuecomment-5981484744
@@ -15942,7 +15942,7 @@ CVE-2026-96883 (pgcollection is an open source extension to PostgreSQL. A type c
CVE-2026-96874 (Improper neutralization of input during web page generation ('cross-si ...)
NOT-FOR-US: X-SpringBoot
CVE-2026-96812 (Improper Exposure of Resource to Wrong Sphere in the host file helper ...)
- - golang-gvisor-gvisor <unfixed>
+ - golang-gvisor-gvisor <unfixed> (bug #1150508)
NOTE: Fixed by: https://github.com/google/gvisor/commit/573a9e73cf844f9196cbdf776d6a98836b5c0f5c (release-20260824.0)
CVE-2026-96766 (The GeoDirectory \u2013 WP Business Directory Plugin and Classified Li ...)
NOT-FOR-US: WordPress plugin
@@ -51587,7 +51587,7 @@ CVE-2026-67394 (A critical local privilege escalation via OS command injection v
CVE-2026-65643 (Eval injection in cPanel 11.138.0.0 and earlier allows remote authenti ...)
NOT-FOR-US: cPanel
CVE-2026-62993 (Smarty is a template engine for PHP, facilitating the separation of pr ...)
- - smarty4 <unfixed>
+ - smarty4 <unfixed> (bug #1150507)
[trixie] - smarty4 <no-dsa> (Minor issue)
[bookworm] - smarty4 <postponed> (Minor issue)
- smarty3 <unfixed>
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fbdd5f02c33ba85907b8039795173b11b5f788dc
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fbdd5f02c33ba85907b8039795173b11b5f788dc
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261010/3588e4a0/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list