[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Tue Oct 13 12:03:41 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
80df8c53 by Moritz Muehlenhoff at 2026-10-13T12:57:39+02:00
trixie triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -650,7 +650,10 @@ CVE-2020-37279 (easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command inject
TODO: check
CVE-2026-103658 (GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a ...)
- aspell <unfixed>
+ [trixie] - aspell <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2550001
+ NOTE: https://github.com/GNUAspell/aspell/security/advisories/GHSA-p35p-2mw5-fj5j
+ NOTE: https://github.com/GNUAspell/aspell/commit/b830b6e
CVE-2026-109379 (Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerabi ...)
NOT-FOR-US: Cockpit CMS
CVE-2026-109380 (modern-tar 0.3.5 through 0.8.5 contains a memory exhaustion vulnerabil ...)
@@ -668,6 +671,7 @@ CVE-2026-96618 (Improper Handling of Highly Compressed Data (Data Amplification)
NOT-FOR-US: hexpm (server side)
CVE-2026-96612 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- erlang-hex <unfixed>
+ [trixie] - erlang-hex <no-dsa> (Minor issue)
NOTE: https://github.com/hexpm/hex/security/advisories/GHSA-2vjj-c5hr-6xc3
NOTE: https://cna.erlef.org/cves/CVE-2026-96612.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-96612
@@ -763,6 +767,7 @@ CVE-2026-83535 (A flaw was found in openstack-network-exporter. When an operator
NOT-FOR-US: Red Hat openstack-network-exporter
CVE-2026-81856 (Improper Neutralization of Escape, Meta, or Control Sequences vulnerab ...)
- erlang-hex <unfixed>
+ [trixie] - erlang-hex <no-dsa> (Minor issue)
NOTE: https://github.com/hexpm/hex/security/advisories/GHSA-fpmj-3cxg-p766
NOTE: https://cna.erlef.org/cves/CVE-2026-81856.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-81856
@@ -867,15 +872,19 @@ CVE-2026-109352 (LibreNMS before 26.9.0 contains a stored cross-site scripting v
NOT-FOR-US: LibreNMS
CVE-2026-109351 (Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory alloca ...)
- rust-gix-pack <unfixed>
+ [trixie] - rust-gix-pack <no-dsa> (Minor issue)
NOTE: https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-x862-c2wj-4mwr
CVE-2026-109350 (Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerabi ...)
- rust-gix-pack <unfixed>
+ [trixie] - rust-gix-pack <no-dsa> (Minor issue)
NOTE: https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-mpf5-465h-mr53
CVE-2026-109349 (gitoxide gix-pack before 0.75.0 contains a reachable assertion in Byte ...)
- rust-gix-pack <unfixed>
+ [trixie] - rust-gix-pack <no-dsa> (Minor issue)
NOTE: https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-633h-mqjc-8rwg
CVE-2026-109348 (Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulner ...)
- rust-gix-mailmap <unfixed>
+ [trixie] - rust-gix-mailmap <no-dsa> (Minor issue)
NOTE: https://github.com/GitoxideLabs/gitoxide/security/advisories/GHSA-pmpw-wwcm-r8rc
CVE-2026-109347 (Adminer before 6.1.1 contains a remote code execution vulnerability th ...)
TODO: check
@@ -1733,6 +1742,7 @@ CVE-2026-108980 (Blinko through 1.8.8 allows directory traversal, overwriting st
NOT-FOR-US: Blinko
CVE-2026-108978 (Heap-based buffer overflow vulnerability in Samsung Opensource rlottie ...)
- rlottie <unfixed>
+ [trixie] - rlottie <no-dsa> (Minor issue)
NOTE: https://github.com/Samsung/rlottie/pull/609/
CVE-2026-108976 (GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command inje ...)
- emacs <not-affected> (Incomplete fix for for CVE-2026-79992 not applied)
@@ -1997,6 +2007,7 @@ CVE-2026-108736 (Speedtest Tracker through 1.15.0 contains an IP allowlist bypas
NOT-FOR-US: Speedtest Tracker
CVE-2026-108735 (Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vu ...)
- miniflux <unfixed>
+ [trixie] - miniflux <no-dsa> (Minor issue)
NOTE: https://hackmd.io/@haind03/miniflux-feed-proxy-url-private-network-bypass
NOTE: https://github.com/miniflux/v2/pull/4513
NOTE: Fixed by: https://github.com/miniflux/v2/commit/b683d3b46e4021aa08675a534ab0497af1f7cf03
@@ -2078,8 +2089,7 @@ CVE-2026-108575 (A vulnerability has been found in BerriAI LiteLLM up to 1.94.0.
CVE-2026-108574 (A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by thi ...)
NOT-FOR-US: BerriAI LiteLLM
CVE-2026-108573 (A vulnerability was detected in Open Asset Import Library Assimp up to ...)
- - assimp <unfixed>
- TODO: check upstream details
+ - assimp <undetermined>
CVE-2026-108572 (A security vulnerability has been detected in Casdoor up to 3.164.0/4. ...)
NOT-FOR-US: Casdoor
CVE-2026-108571 (A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. T ...)
@@ -3245,6 +3255,7 @@ CVE-2026-96327 (Improper Neutralization of Special Elements used in an SQL Comma
NOT-FOR-US: WordPress plugin or theme
CVE-2026-95702 (Use-after-free vulnerability in VFS in Google gVisor prior to release ...)
- golang-gvisor-gvisor <unfixed> (bug #1150510)
+ [trixie] - golang-gvisor-gvisor <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/google/gvisor/commit/90bc4fc36fe442257a06ba15df00371561c183ed (release-20260831.0)
NOTE: Fixed by: https://github.com/google/gvisor/commit/25c75149bc0eeaa6a3a49b9bbe3473588b2af6df (release-20260824.0)
NOTE: Fixed by: https://github.com/google/gvisor/commit/e4efb89c787ef15b09e68d561f1303380e1d5a77 (release-20260831.0)
@@ -3500,6 +3511,7 @@ CVE-2026-108124 (Improper neutralization of special elements used in an SQL comm
NOT-FOR-US: wp-post-author
CVE-2026-108119 (A flaw was found in busybox. The tar applet's deferred link-creation h ...)
- busybox <unfixed>
+ [trixie] - busybox <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2548611
CVE-2026-108113 (ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file uploa ...)
NOT-FOR-US: ILIAS
@@ -3551,6 +3563,7 @@ CVE-2026-107937 (In Apache CXF, the parser for multipart/MTOM attachment part he
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-107935 (A path traversal vulnerability was found in gvproxy, the network forwa ...)
- golang-github-containers-gvisor-tap-vsocks <unfixed> (bug #1150513)
+ [trixie] - golang-github-containers-gvisor-tap-vsocks <no-dsa> (Minor issue)
NOTE: https://github.com/containers/gvisor-tap-vsock/pull/718
CVE-2026-107841 (pacioli provides least-privilege governance and a governed agent broke ...)
NOT-FOR-US: pacioli for ERPNext
@@ -4470,6 +4483,7 @@ CVE-2026-107379 (savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-
NOT-FOR-US: darylldoyle svg-sanitizer
CVE-2026-107378 (CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Pr ...)
- cairosvg 2.9.0-1
+ [trixie] - cairosvg <no-dsa> (Minor issue)
NOTE: https://github.com/Kozea/CairoSVG/security/advisories/GHSA-f38f-5xpm-9r7c
NOTE: Fixed by: https://github.com/Kozea/CairoSVG/commit/6dde8685ed3f19837767bce7a13a5491e3d0e0bf (2.9.0)
CVE-2026-107377 (datamodel-code-generator generates Python data models from schema defi ...)
@@ -4793,6 +4807,7 @@ CVE-2026-97032 (HTTP/2 servers could end up crashing due to inadvertently modify
- golang-1.19 <removed>
[bookworm] - golang-1.19 <postponed> (Minor issue)
- golang-golang-x-net 1:0.60.0-1
+ [trixie] - golang-golang-x-net <no-dsa> (Minor issue)
[bookworm] - golang-golang-x-net <postponed> (minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81867
@@ -4808,6 +4823,7 @@ CVE-2026-78659 (When "Trailer" headers are sent by a client, the HTTP server int
- golang-1.19 <removed>
[bookworm] - golang-1.19 <postponed> (Minor issue)
- golang-golang-x-net 1:0.60.0-1
+ [trixie] - golang-golang-x-net <no-dsa> (Minor issue)
[bookworm] - golang-golang-x-net <postponed> (minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81857
@@ -4919,6 +4935,7 @@ CVE-2026-78669 (A malicious HTTP/2 peer can cause excessive CPU consumption in t
- golang-1.19 <removed>
[bookworm] - golang-1.19 <postponed> (Minor issue)
- golang-golang-x-net 1:0.60.0-1
+ [trixie] - golang-golang-x-net <no-dsa> (Minor issue)
[bookworm] - golang-golang-x-net <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81742
@@ -4934,6 +4951,7 @@ CVE-2026-78660 (Historically, we have been rather lax about malformed framing-re
- golang-1.19 <removed>
[bookworm] - golang-1.19 <postponed> (Minor issue)
- golang-golang-x-net 1:0.60.0-1
+ [trixie] - golang-golang-x-net <no-dsa> (Minor issue)
[bookworm] - golang-golang-x-net <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81115
@@ -4968,6 +4986,7 @@ CVE-2026-78663 (The HTTP/2 server can refund connection-level flow control twice
- golang-1.19 <removed>
[bookworm] - golang-1.19 <postponed> (Minor issue)
- golang-golang-x-net 1:0.60.0-1
+ [trixie] - golang-golang-x-net <no-dsa> (Minor issue)
[bookworm] - golang-golang-x-net <postponed> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/08/9
NOTE: https://github.com/golang/go/issues/81743
@@ -5221,6 +5240,7 @@ CVE-2026-107354
REJECTED
CVE-2026-107353 (traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5. ...)
- node-traverse <unfixed> (bug #1150332)
+ [trixie] - node-traverse <no-dsa> (Minor issue)
NOTE: https://github.com/ljharb/js-traverse/security/advisories/GHSA-rj28-8w7x-jmqc
NOTE: https://github.com/ljharb/js-traverse/commit/81ccab43e379cf42eb2a5f689630f7f79b3d71b8 (v0.6.12)
NOTE: https://github.com/ljharb/js-traverse/commit/37a9ebd103d2a259c824c29cdcc3f0dfe1acffce (v0.6.12)
@@ -6909,9 +6929,11 @@ CVE-2026-106512 (The CakeResponse::download() method in lib/Cake/Network/CakeRes
CVE-2026-106511 (MultiversX's multisig-improved (repository: mx-multisig-and-modules) r ...)
NOT-FOR-US: MultiversX
CVE-2026-106443 (WeasyPrint helps web developers to create PDF documents. Prior to 70.0 ...)
- - weasyprint 70.0-1 (bug #1150245)
+ - weasyprint 70.0-1 (bug #1150245; unimportant)
NOTE: https://github.com/Kozea/WeasyPrint/security/advisories/GHSA-r543-q48m-4c9j
NOTE: Fixed by: https://github.com/Kozea/WeasyPrint/commit/39cd37ce1610bd890388e26591c569db1cbab542 (v70.0)
+ NOTE: Not a security issue in weasyprint per se, just hardening against Ghostscript security issues
+ NOTE: which are fixed in Debian anyway
CVE-2026-106442 (Hydra is a framework for elegantly configuring complex applications. F ...)
NOT-FOR-US: Hydra (different from src:hydra)
CVE-2026-106441 (Hydra is a framework for elegantly configuring complex applications. P ...)
@@ -8742,6 +8764,7 @@ CVE-2026-93315 (When proxy networking with CA injection is enabled, a build can
TODO: check security impact on docker.io
CVE-2026-92821 (A flaw was found in SSSD. When configured to evaluate password expirat ...)
- sssd <unfixed> (bug #1150199)
+ [trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479031
CVE-2026-91107 (openSIS Classic 9.3 allows an authenticated user with the built-in tea ...)
NOT-FOR-US: OS4ED openSIS
@@ -9057,16 +9080,20 @@ CVE-2026-104033 (A flaw was found in SSSD. When configured to enforce account ex
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479271
CVE-2026-104032 (A flaw was found in SSSD. An unprivileged local user can repeatedly re ...)
- sssd <unfixed> (bug #1150238)
+ [trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479381
CVE-2026-104031 (A flaw was found in SSSD. In configurations where the autofs responder ...)
- sssd <unfixed> (bug #1150238)
+ [trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479418
CVE-2026-104030 (A flaw was found in sssd. This vulnerability allows a local user to ca ...)
- - sssd <unfixed> (bug #1150238)
+ - sssd <unfixed> (bug #1150238; unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479429
+ NOTE: Negligible security impact, SSSD on Debian is socket-activated and would just restart
CVE-2026-104029 (A flaw was found in SSSD. A local attacker can exploit this vulnerabil ...)
- - sssd <unfixed> (bug #1150238)
+ - sssd <unfixed> (bug #1150238; unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479444
+ NOTE: Negligible security impact, SSSD on Debian is socket-activated and would just restart
CVE-2026-103546 (In MongoDB Controllers for Kubernetes, insufficient validation of Ops ...)
NOT-FOR-US: MongoDB Controllers for Kubernetes
CVE-2026-103433 (Docker Buildx Bake does not request the expected fs.read approval for ...)
@@ -19190,6 +19217,7 @@ CVE-2026-96874 (Improper neutralization of input during web page generation ('cr
NOT-FOR-US: X-SpringBoot
CVE-2026-96812 (Improper Exposure of Resource to Wrong Sphere in the host file helper ...)
- golang-gvisor-gvisor <unfixed> (bug #1150508)
+ [trixie] - golang-gvisor-gvisor <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/google/gvisor/commit/573a9e73cf844f9196cbdf776d6a98836b5c0f5c (release-20260824.0)
CVE-2026-96766 (The GeoDirectory \u2013 WP Business Directory Plugin and Classified Li ...)
NOT-FOR-US: WordPress plugin
@@ -21993,6 +22021,7 @@ CVE-2025-32000 (HCL Sametime is vulnerable to insufficient input sanitization. T
NOT-FOR-US: HCL
CVE-2026-107363 (In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bin ...)
- zaqar 23.0.0-2 (bug #1150261)
+ [trixie] - zaqar <no-dsa> (Minor issue)
NOTE: https://security.openstack.org/ossa/OSSA-2026-043.html
NOTE: https://bugs.launchpad.net/ossa/+bug/2161402
CVE-2026-97404 (In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Si ...)
@@ -29052,6 +29081,7 @@ CVE-2026-92926 (A vulnerability has been found in code-projects Matrimonial Syst
CVE-2026-92925 (A flaw was found in Redis community. The cluster bus packet parser, re ...)
{DLA-4794-1}
- redis 5:8.0.6-3 (bug #1148265)
+ [trixie] - redis <no-dsa> (Minor issue)
NOTE: https://github.com/redis/redis/pull/15263
NOTE: Fixed by: https://github.com/redis/redis/commit/37894faeea11e2db28b9fc2af378a762d2c36523 (8.10-rc1)
TODO: check if redict affected
@@ -52800,6 +52830,7 @@ CVE-2026-82884 (The All in One SEO WordPress plugin before 5.0.0.1 does not sani
NOT-FOR-US: WordPress plugin
CVE-2026-82522 (libjxl before 0.12 contains an integer underflow vulnerability in the ...)
- jpeg-xl <unfixed> (bug #1146874)
+ [trixie] - jpeg-xl <no-dsa> (Minor issue)
NOTE: https://github.com/libjxl/libjxl/pull/4885
NOTE: https://github.com/libjxl/libjxl/commit/22ad80af1454f0444ea34115e49ed40517147d68 (v0.12.0)
CVE-2026-82404 (TOON is a compact, human-readable serialization of JSON data for LLM p ...)
@@ -54750,6 +54781,7 @@ CVE-2026-82398 (pypdf is a free and open-source pure-python PDF library. Prior t
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/4959848e057e37c218dccad7465259210923faaa (6.15.0)
CVE-2026-82397 (Tornado is a Python web framework and asynchronous networking library. ...)
- python-tornado <unfixed> (bug #1146475)
+ [trixie] - python-tornado <no-dsa> (Minor issue)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de (v6.5.8)
CVE-2026-82396 (Sulu is an open-source PHP content management system based on the Symf ...)
@@ -55152,6 +55184,7 @@ CVE-2026-82678 (A vulnerability was identified in diem-project diem up to 5.1.3.
CVE-2026-82677 (A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is ...)
- redict <unfixed>
- redis <unfixed>
+ [trixie] - redis <no-dsa> (Minor issue)
[bookworm] - redis <postponed> (Minor issue; requires a loaded module)
- valkey 9.1.2-1 (bug #1146641)
NOTE: https://github.com/valkey-io/valkey/issues/4200
@@ -55203,6 +55236,7 @@ CVE-2026-82659 (nodemailer before 9.0.1 fails to apply disableFileAccess and dis
CVE-2026-82631 (A security flaw has been discovered in valkey-io valkey 9.1.0. The aff ...)
- redict <unfixed>
- redis <unfixed>
+ [trixie] - redis <no-dsa> (Minor issue)
[bookworm] - redis <postponed> (Minor issue; requires a loaded module)
- valkey 9.1.2-1 (bug #1146641)
NOTE: https://github.com/valkey-io/valkey/issues/4198
@@ -65488,9 +65522,12 @@ CVE-2026-70653 (libvips is a fast image processing library with low memory needs
NOTE: Fixed by: https://github.com/libvips/libvips/commit/dc945573e15d598054e701c65b90a35b16b19304 (v8.18.3-rc1)
CVE-2026-70652 (libvips is a fast image processing library with low memory needs. Prio ...)
- vips 8.18.3-1
+ [trixie] - vips <not-affected> (Vulnerable code not present)
+ [bookworm] - vips <not-affected> (Vulnerable code not present)
NOTE: https://github.com/libvips/libvips/security/advisories/GHSA-h27h-jf9v-m8rg
NOTE: https://github.com/libvips/libvips/pull/5039
NOTE: Fixed by: https://github.com/libvips/libvips/commit/cff17794f0698a4f47c74bb31c9700b2c83252a8 (v8.18.3-rc1)
+ NOTE: Introduced by https://github.com/libvips/libvips/commit/db44003db1b8462ae1f6e790da4b59fce3b11c2a (v8.18.7)
CVE-2026-70651 (libvips is a fast image processing library with low memory needs. Prio ...)
{DSA-6552-1}
- vips 8.18.3-1
@@ -92836,6 +92873,7 @@ CVE-2026-58039 (A flaw in Node.js Permission Model enforcement allows process.re
NOTE: Fixed by: https://github.com/nodejs/node/commit/ed18b9cc073f0b63268d6f2c84730b18e90fdd20 (v22.23.2)
CVE-2026-58045 (A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigge ...)
- nodejs 24.19.0+dfsg+~cs24.13.3-1
+ [trixie] - nodejs <postponed> (Fix along in next DSA)
NOTE: https://nodejs.org/en/blog/vulnerability/july-2026-security-releases#nodezlib-sync-apis-can-crash-on-spoofed-typedarray-length-cve-2026-58045---medium
NOTE: Fixed by: https://github.com/nodejs/node/commit/0d072480c3dbbad6db8723e39786321646989343 (v22.23.2)
CVE-2026-58042 (A flaw in Node.js can cause dns.resolveAny() Aborts the Node.js Proces ...)
@@ -317553,6 +317591,7 @@ CVE-2025-31485 (API Platform Core is a system to create hypermedia-driven REST a
NOT-FOR-US: API Platform Core
CVE-2025-31483 (Miniflux is a feed reader. Due to a weak Content Security Policy on th ...)
- miniflux 2.2.12-1
+ [trixie] - miniflux <no-dsa> (Minor issue)
NOTE: https://github.com/miniflux/v2/security/advisories/GHSA-cq88-842x-2jhp
NOTE: Fixed by: https://github.com/miniflux/v2/commit/cb695e653a08af4cabcb277c271ce74bd0c746e6 (2.2.7)
CVE-2025-31481 (API Platform Core is a system to create hypermedia-driven REST and Gra ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/80df8c532b21b8c7610b09d4ca4380ab7e2910c4
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/80df8c532b21b8c7610b09d4ca4380ab7e2910c4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261013/871d47de/attachment.htm>
More information about the debian-security-tracker-commits
mailing list