[Git][security-tracker-team/security-tracker][master] bookworm triagging

Sun Oct 11 18:32:23 BST 2026


Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker


Commits:
53dd23d1 by Bastien Roucariès at 2026-10-11T19:32:10+02:00
bookworm triagging

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -806,6 +806,7 @@ CVE-2026-107373 (ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T
 CVE-2026-69150
 	- keepassxc <unfixed> (bug #1150520)
 	[trixie] - keepassxc <no-dsa> (Minor issue)
+	[bookworm] - keepassxc <postponed> (Minor issue)
 	NOTE: https://github.com/keepassxreboot/keepassxc/security/advisories/GHSA-4642-49vv-4p43
 	NOTE: https://github.com/keepassxreboot/keepassxc/pull/13500
 	NOTE: Fixed by: https://github.com/keepassxreboot/keepassxc/commit/6a534f38c61295d60b0e937739a12511e76dbfeb (2.8.0-beta1)
@@ -2089,6 +2090,7 @@ CVE-2026-107779 (Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ea
 CVE-2026-107778 (MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereferen ...)
 	- krb5 <unfixed> (bug #1150461)
 	[trixie] - krb5 <no-dsa> (Minor issue)
+	[bookworm] - krb5 <postponed> (Minor issue)
 	NOTE: https://github.com/krb5/krb5/pull/1511
 	NOTE: Fixed by: https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08 (master)
 	NOTE: Fixed by: https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a (krb5-1.22 branch)
@@ -2156,6 +2158,7 @@ CVE-2026-107709 (A path traversal vulnerability exists in Bower decompress-zip t
 CVE-2026-107708 (MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerabil ...)
 	- krb5 <unfixed> (bug #1150461)
 	[trixie] - krb5 <no-dsa> (Minor issue)
+	[bookworm] - krb5 <postponed> (Minor issue)
 	NOTE: https://github.com/krb5/krb5/pull/1510
 	NOTE: Fixed by: https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7 (master)
 	NOTE: Fixed by: https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d (krb5-1.22 branch)
@@ -4092,6 +4095,7 @@ CVE-2026-106455 (Backstage is an open framework for building developer portals.
 CVE-2026-106454 (Twisted is an event-based framework for internet applications, support ...)
 	- twisted 26.4.0-5 (bug #1150248)
 	[trixie] - twisted <no-dsa> (Minor issue)
+	[bookworm] - twisted <postponed> (Minor issue)
 	NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-8pqf-f4m5-798g
 	NOTE: https://github.com/twisted/twisted/pull/12788
 	NOTE: Fixed by: https://github.com/twisted/twisted/commit/2f8a3c29246f4eb324690e06a9767a11dc4aec9f
@@ -4497,8 +4501,10 @@ CVE-2026-82924 (Improper Control of Interaction Frequency vulnerability in Pusul
 CVE-2026-82531 (Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vul ...)
 	- smarty4 <unfixed> (bug #1150192)
 	[trixie] - smarty4 <no-dsa> (Minor issue)
+	[bookworm] - smarty4 <postponed> (minor issue)
 	- smarty3 <unfixed>
 	[trixie] - smarty3 <no-dsa> (Minor issue)
+	[bookworm] - smarty3 <postponed> (minor issue)
 	NOTE: https://github.com/smarty-php/smarty/security/advisories/GHSA-3w63-v7pm-cq9x
 	NOTE: Fixed by: https://github.com/smarty-php/smarty/commit/1cba51cb813563eb61d963c83d28cd59f26b858d (v4.5.8)
 CVE-2026-82162 (Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an ...)
@@ -5352,6 +5358,7 @@ CVE-2026-106033 (A DOM-based Cross-Site Scripting (XSS) vulnerability exists in
 CVE-2026-106026 (tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability i ...)
 	- tftp-hpa 7.1-1
 	[trixie] - tftp-hpa <no-dsa> (Minor issue)
+	[bookworm] - tftp-hpa <postponed> (Minor issue)
 	NOTE: https://git.kernel.org/pub/scm/network/tftp/tftp-hpa.git/commit/?id=6735086fb6475c3e1f1daf9829836b3d06f14291 (tftp-hpa-6.0)
 CVE-2026-106016 (Mitigation bypass in the File Handling component. This vulnerability w ...)
 	- firefox 157.0.1-1
@@ -6444,6 +6451,7 @@ CVE-2026-105783 (Joplin is an open source note-taking and to-do application that
 CVE-2026-105782 (Scrapy is a high-level web crawling and scraping framework for Python. ...)
 	- python-scrapy 2.14.2-1
 	[trixie] - python-scrapy <no-dsa> (Minor issue)
+	[bookworm] - python-scrapy <postponed> (Minor issue)
 	NOTE: https://github.com/scrapy/scrapy/security/advisories/GHSA-cwxj-rr6w-m6w7
 	NOTE: Fixed by: https://github.com/scrapy/scrapy/commit/b6e5c58ae707a3d4bb491537b5519534050047e0
 CVE-2026-105778 (A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affect ...)
@@ -8706,10 +8714,12 @@ CVE-2026-102977
 CVE-2026-XXXX [MFA auth receipt and TOTP are not invalidated after use, allowing replay attacks]
 	- keystone 2:30.0.0~rc1-2 (bug #1149305)
 	[trixie] - keystone <no-dsa> (Minor issue)
+	[bookworm] - keystone <postponed> (Minor issue)
 	NOTE: https://bugs.launchpad.net/keystone/+bug/2157347
 CVE-2026-XXXX [POST /v3/users/{id}/password does not verify MFA when MFA rules are configured, allowing account lockout with stolen password alone]
 	- keystone 2:30.0.0~rc1-2 (bug #1149304)
 	[trixie] - keystone <no-dsa> (Minor issue)
+	[bookworm] - keystone <postponed> (Minor issue)
 	NOTE: https://bugs.launchpad.net/keystone/+bug/2158970
 CVE-2026-97318 (The Giveaways and Contests by RafflePress  WordPress plugin before 1.1 ...)
 	NOT-FOR-US: WordPress plugin



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/53dd23d1fb318a8ed3f0a2085bd59cbf6f091e14

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/53dd23d1fb318a8ed3f0a2085bd59cbf6f091e14
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261011/c8750d71/attachment.htm>
