[Git][security-tracker-team/security-tracker][master] Update status for two emacs issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5b0792bc by Salvatore Bonaccorso at 2026-10-12T10:21:04+02:00
Update status for two emacs issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -103,7 +103,9 @@ CVE-2026-108980 (Blinko through 1.8.8 allows directory traversal, overwriting st
 CVE-2026-108978 (Heap-based buffer overflow vulnerability in Samsung Opensource rlottie ...)
 	TODO: check
 CVE-2026-108976 (GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command inje ...)
-	TODO: check
+	- emacs <not-affected> (Incomplete fix for for CVE-2026-79992 not applied)
+	NOTE: https://www.openwall.com/lists/oss-security/2026/10/11/1
+	NOTE: CVE exists for an incomplete fix for CVE-2026-79992
 CVE-2026-108963 (databasement before 1.8.2 allows remote code execution because it runs ...)
 	TODO: check
 CVE-2026-108809 (A vulnerability was identified in Eleveo Call Recording Software up to ...)
@@ -65673,6 +65675,8 @@ CVE-2026-79992 (A flaw was found in Emacs TRAMP. A local attacker could exploit
 	- emacs <unfixed> (bug #1145049)
 	NOTE: https://www.openwall.com/lists/oss-security/2026/08/21/1
 	NOTE: Fixed by: https://cgit.git.savannah.gnu.org/cgit/emacs.git/commit/?id=f3e7104d05bdb8e32ba13bf75604108ad88536dc
+	NOTE: When fixing this issue make sure to make the fix complete to not open up CVE-2026-108976
+	NOTE: https://www.openwall.com/lists/oss-security/2026/10/11/1
 CVE-2026-96269 (GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon openi ...)
 	{DSA-6468-1}
 	- emacs 1:30.2+1-11



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5b0792bc32806fa71f94466ec28b398a404fc7e0

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5b0792bc32806fa71f94466ec28b398a404fc7e0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261012/c0f4ae57/attachment.htm>