[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Tue Oct 13 14:09:14 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
3cca6e1b by Moritz Muehlenhoff at 2026-10-13T15:08:37+02:00
trixie triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -263,6 +263,7 @@ CVE-2026-14210 (GitLab has remediated an issue in GitLab CE/EE affecting all ver
NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
CVE-2026-109786 (In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (conf ...)
- fail2ban <unfixed>
+ [trixie] - fail2ban <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/fail2ban/fail2ban/commit/ddd879d22664904ace24e1255ac6571808c58187
CVE-2026-109758 (Perforce Helix Authentication Service (HAS) deployments that retain th ...)
NOT-FOR-US: Perforce Helix Authentication Service (HAS) deployment
@@ -670,7 +671,9 @@ CVE-2026-109561 (goose from 1.28.0 before 1.44.0 contains an authorization bypas
NOT-FOR-US: Goose
CVE-2026-93879
- libhibernate-validator-java <unfixed>
+ [trixie] - libhibernate-validator-java <no-dsa> (Minor issue)
- libhibernate-validator4-java <unfixed>
+ [trixie] - libhibernate-validator4-java <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2540892
TODO: check, missing further details in Red Hat bugzilla entry at 2026-10-13
CVE-2026-9191 (Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x release ...)
@@ -1739,6 +1742,7 @@ CVE-2026-109080 (SQL injection in the bulk license plate search of the Flock Nig
NOT-FOR-US: Flock Night Shift hosted service
CVE-2026-108985 (ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-boun ...)
- libnfs <unfixed>
+ [trixie] - libnfs <no-dsa> (Minor issue)
NOTE: Fixed by: https://github.com/sahlberg/libnfs/commit/7613236464317bee2d9636f087f995148de4db27
CVE-2026-108982 (VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended ...)
NOT-FOR-US: VeraCrypt
@@ -4373,11 +4377,13 @@ CVE-2026-107637 (pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an im
CVE-2026-107636 (pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment va ...)
NOT-FOR-US: pH7Builder (pH7 Social Dating CMS)
CVE-2026-107635 (Dislocker through 0.7.3 contains an integer underflow vulnerability in ...)
- - dislocker <unfixed> (bug #1150456)
+ - dislocker <unfixed> (bug #1150456; unimportant)
NOTE: Fixed by: https://github.com/Aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581
+ NOTE: Crash in CLI tool, no security impact
CVE-2026-107634 (Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerabili ...)
- - dislocker <unfixed> (bug #1150456)
+ - dislocker <unfixed> (bug #1150456; unimportant)
NOTE: Fixed by: https://github.com/Aorimn/dislocker/commit/9158e9e41dd669b360cbc53cc18ccae729b67b48
+ NOTE: Crash in CLI tool, no security impact
CVE-2026-107623 (A flaw was found in the OIDC Dynamic Client Registration (DCR) compone ...)
- keycloak <itp> (bug #1088287)
CVE-2026-107615 (An uncontrolled search path element vulnerability in GlavSoft TightVNC ...)
@@ -4601,11 +4607,13 @@ CVE-2026-106435 (The MongoDB Python Driver's binary accelerator can read outside
NOTE: Fixed by: https://github.com/mongodb/mongo-python-driver/commit/bb8d4e195275e75bd94ebeffb53cc747d357fcf4 (4.18.3)
CVE-2026-106434 (The explicit decryption component of MongoDB libmongocrypt can return ...)
- libmongocrypt 1.20.5-1
+ [trixie] - libmongocrypt <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/MONGOCRYPT-966
NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/5e68bbf5825b59978e21c595c1af6d39a5e00e94 (1.20.5)
NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/e9d07e8a7d593dde93681943b7070634aebd1980 (1.20.5)
CVE-2026-106433 (Improper state management in MongoDB libmongocrypt can cause provider- ...)
- libmongocrypt 1.20.5-1
+ [trixie] - libmongocrypt <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/MONGOCRYPT-964
NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/556bcb70b6efecb7f568d824b03469df3a3bc91a (1.20.5)
NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/8bc580ea69eea13a932197221edf72830fbc38a1 (1.20.5)
@@ -4628,6 +4636,7 @@ CVE-2026-106430 (The MongoDB C++ Driver discards content after an embedded NUL b
NOTE: Fixed by: https://github.com/mongodb/mongo-cxx-driver/commit/5a6efb4ae260a3dd6d243a1a1b1e4d788e392416 (4.6.1)
CVE-2026-106429 (An integer underflow in the KMS endpoint-parsing logic of MongoDB libm ...)
- libmongocrypt 1.20.5-1
+ [trixie] - libmongocrypt <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/MONGOCRYPT-986
NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/f2ea9f97dff40eb8b470a4fc3d407bafb4650d88 (1.20.5)
NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/1450714452daaaa9da29359ab6a6b1a0c3a1fa47 (1.20.5)
@@ -5322,6 +5331,7 @@ CVE-2026-107176 (A flaw was found in the cluster-samples-operator. The RBAC Role
NOT-FOR-US: cluster-samples-operator
CVE-2026-107161 (A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_ ...)
- cyrus-sasl2 <unfixed> (bug #1150516)
+ [trixie] - cyrus-sasl2 <postponed> (Revisit when fixed upstream)
NOTE: https://github.com/cyrusimap/cyrus-sasl/issues/889
NOTE: https://github.com/cyrusimap/cyrus-sasl/pull/892
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2460420
@@ -9076,15 +9086,18 @@ CVE-2026-104037 (A flaw was found in SSSD. A local attacker can exploit this iss
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479030
CVE-2026-104036 (A flaw was found in SSSD's NFS idmap plugin. When retrieving cached us ...)
- sssd <unfixed> (bug #1150238)
+ [trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479057
CVE-2026-104035 (A flaw was found in SSSD. An issue in the Kerberos Credential Manager ...)
- - sssd <unfixed> (bug #1150238)
+ - sssd <unfixed> (bug #1150238; unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479107
+ NOTE: Negligible security impact, SSSD on Debian is socket-activated and would just restart
CVE-2026-104034 (A flaw was found in SSSD. A use-after-free vulnerability exists in the ...)
- sssd <unfixed> (bug #1150238)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479178
CVE-2026-104033 (A flaw was found in SSSD. When configured to enforce account expiratio ...)
- sssd <unfixed> (bug #1150238)
+ [trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479271
CVE-2026-104032 (A flaw was found in SSSD. An unprivileged local user can repeatedly re ...)
- sssd <unfixed> (bug #1150238)
@@ -9106,6 +9119,7 @@ CVE-2026-103546 (In MongoDB Controllers for Kubernetes, insufficient validation
NOT-FOR-US: MongoDB Controllers for Kubernetes
CVE-2026-103433 (Docker Buildx Bake does not request the expected fs.read approval for ...)
- docker-buildx <unfixed> (bug #1150158)
+ [trixie] - docker-buildx <no-dsa> (Minor issue)
NOTE: https://github.com/docker/buildx/security/advisories/GHSA-p54p-jq4x-rc28
CVE-2026-103348 (Deserialization of Untrusted Data vulnerability in Smackcoders Inc. WP ...)
NOT-FOR-US: WordPress plugin or theme
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3cca6e1b11442c109ffdf73e1bb1c158f0909484
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3cca6e1b11442c109ffdf73e1bb1c158f0909484
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261013/35a9fb51/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list