[Git][security-tracker-team/security-tracker][master] Add another batch of curl issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e683e0d3 by Salvatore Bonaccorso at 2026-10-14T09:31:31+02:00
Add another batch of curl issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3500,6 +3500,71 @@ CVE-2026-100112 (Photoshop Desktop is affected by an out-of-bounds write vulnera
 	NOT-FOR-US: Adobe
 CVE-2026-100111 (Photoshop Desktop is affected by an out-of-bounds write vulnerability  ...)
 	NOT-FOR-US: Adobe
+CVE-2026-107929
+	- curl 8.23.0-1
+	[trixie] - curl <no-dsa> (Minor issue)
+	[bookworm] - curl <not-affected> (Vulnerable code not present)
+	NOTE: https://curl.se/docs/CVE-2026-107929.html
+	NOTE: Introduced with: https://github.com/curl/curl/commit/3060557af702dd59155ea703a0790455c2f49a59 (curl-8_9_0)
+	NOTE: Fixed by: https://github.com/curl/curl/commit/d37d79df1e01066417aff0a9e6bc675edad3edba (curl-8_23_0)
+CVE-2026-107928
+	- curl 8.23.0-1
+	[trixie] - curl <no-dsa> (Minor issue)
+	NOTE: https://curl.se/docs/CVE-2026-107928.html
+	NOTE: Introduced with: https://github.com/curl/curl/commit/664249d095275ec532f55dd1752d80c8c1093a77 (curl-7_86_0)
+	NOTE: Fixed by: https://github.com/curl/curl/commit/64fb3e7a7b116f690966054f281624152d4a7651 (curl-8_23_0)
+CVE-2026-94266
+	- curl 8.23.0~rc2-1
+	[trixie] - curl <no-dsa> (Minor issue)
+	NOTE: https://curl.se/docs/CVE-2026-94266.html
+	NOTE: Introduced with: https://github.com/curl/curl/commit/46e164069d1a5230e4e64cbd2ff46c46cce056bb (curl-7_62_0)
+	NOTE: Fixed by: https://github.com/curl/curl/commit/7a6bd027d0de2b6857472d35da090ef60cc29f19 (rc-8_23_0-2)
+CVE-2026-94265
+	- curl 8.23.0~rc2-1
+	[trixie] - curl <not-affected> (Vulnerable code not present)
+	[bookworm] - curl <not-affected> (Vulnerable code not present)
+	NOTE: https://curl.se/docs/CVE-2026-94265.html
+	NOTE: Introduced with: https://github.com/curl/curl/commit/8f71d0fde515aa4c68002477356c35bd79927729 (curl-8_21_0)
+	NOTE: Fixed by: https://github.com/curl/curl/commit/557a52f21e37a626725a9e708c02af129c3ece1b (rc-8_23_0-2)
+CVE-2026-92386
+	- curl 8.23.0~rc1-1
+	[trixie] - curl <no-dsa> (Minor issue)
+	[bookworm] - curl <not-affected> (Vulnerable code not present)
+	NOTE: https://curl.se/docs/CVE-2026-92386.html
+	NOTE: Introduced with: https://github.com/curl/curl/commit/142ac257b3242459b284020c59f1902b9687a954 (curl-8_7_0)
+	NOTE: Fixed by: https://github.com/curl/curl/commit/445aa87e13f91c94bc742f54343a2eac924e1765 (rc-8_23_0-1)
+CVE-2026-92387
+	- curl 8.23.0~rc1-1
+	[trixie] - curl <no-dsa> (Minor issue)
+	[bookworm] - curl <not-affected> (Vulnerable code not present)
+	NOTE: https://curl.se/docs/CVE-2026-92387.html
+	NOTE: Introduced with: https://github.com/curl/curl/commit/a5598b6fcb9ec6b57a7770939a0ffb004456f333 (curl-8_10_0)
+	NOTE: Fixed by: https://github.com/curl/curl/commit/753735af87f5c30cb6f60a70342f8bc4bc5fd5db (rc-8_23_0-1)
+CVE-2026-92388
+	- curl 8.23.0~rc1-1
+	[trixie] - curl <no-dsa> (Minor issue)
+	NOTE: https://curl.se/docs/CVE-2026-92388.html
+	NOTE: Introduced with: https://github.com/curl/curl/commit/0825cd80a62c21725fb (curl-7_21_0)
+	NOTE: Fixed by: https://github.com/curl/curl/commit/ba8f8a7f27a5c5e19e4ef212b90b35a93559163e (rc-8_23_0-1)
+	NOTE: Fixed by: https://github.com/curl/curl/commit/b85acacec9b38442741bb019bc992e77b5f665d4 (rc-8_23_0-1)
+CVE-2026-92389
+	- curl 8.23.0~rc1-1
+	[trixie] - curl <no-dsa> (Minor issue)
+	NOTE: https://curl.se/docs/CVE-2026-92389.html
+	NOTE: Introduced with: https://github.com/curl/curl/commit/56d9624b566ac15ffb4b4b6eef220a5000b767e0 (curl-7_15_0)
+	NOTE: https://github.com/curl/curl/commit/63dd390fab905a239a97e2700532929343ebc4e9 (rc-8_23_0-1)
+CVE-2026-92390
+	- curl 8.23.0~rc1-1
+	[trixie] - curl <no-dsa> (Minor issue)
+	NOTE: https://curl.se/docs/CVE-2026-92390.html
+	NOTE: Introduced with: https://github.com/curl/curl/commit/80675818e0417be8c991513b328c5507e93b47e5 (curl-7_20_0)
+	NOTE: Fixed by: https://github.com/curl/curl/commit/c24a69d8cd368de4e25e3540bf0b7b000a31d5a7 (rc-8_23_0-1)
+CVE-2026-92391
+	- curl 8.23.0~rc1-1
+	[trixie] - curl <no-dsa> (Minor issue)
+	NOTE: https://curl.se/docs/CVE-2026-92391.html
+	NOTE: Introduced with: https://github.com/curl/curl/commit/ce0881edee3c78609eae49665fb70264d8786d29 (curl-7_56_0)
+	NOTE: Fixed by: https://github.com/curl/curl/commit/d7546809d5bd548b69ec49fca26565c8f6f0d344 (rc-8_23_0-1)
 CVE-2026-92392
 	{DSA-6558-1}
 	- curl 8.23.0-1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e683e0d3d62c2a0bed8ec03f1cde2427b3aa7db6

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e683e0d3d62c2a0bed8ec03f1cde2427b3aa7db6
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261014/82253118/attachment-0001.htm>