[Git][security-tracker-team/security-tracker][master] buildstream, firefox-esr, sogo DSAs

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0a954f3c by Moritz Mühlenhoff at 2026-10-14T16:06:59+02:00
buildstream, firefox-esr, sogo DSAs

- - - - -


3 changed files:

- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -77042,6 +77042,7 @@ CVE-2024-14045 (A weakness has been identified in OpenBoxes up to 0.9.2. This vu
 	NOT-FOR-US: OpenBoxes
 CVE-2026-XXXX [sogo issues from 5.12.10]
 	- sogo 5.12.10-1
+	[trixie] - sogo 5.12.1-3+deb13u3
 	NOTE: https://www.sogo.nu/news/2026/sogo-v51210-released.html
 CVE-2026-9859 (Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 1 ...)
 	- mattermost-server <itp> (bug #823556)


=====================================
data/DSA/list
=====================================
@@ -1,3 +1,12 @@
+[14 Oct 2026] DSA-6561-1 sogo - security update
+	{CVE-2026-93453}
+	[trixie] - sogo 5.12.1-3+deb13u3
+[14 Oct 2026] DSA-6560-1 firefox-esr - security update
+	{CVE-2026-109705 CVE-2026-109706 CVE-2026-109707 CVE-2026-109708 CVE-2026-109709 CVE-2026-109710 CVE-2026-109711 CVE-2026-109712 CVE-2026-109713 CVE-2026-109715 CVE-2026-109716 CVE-2026-109717 CVE-2026-109718 CVE-2026-109719 CVE-2026-109720 CVE-2026-109721 CVE-2026-109722 CVE-2026-109723 CVE-2026-109724 CVE-2026-109725 CVE-2026-109726 CVE-2026-109727 CVE-2026-109728 CVE-2026-109729 CVE-2026-109730 CVE-2026-109731 CVE-2026-109732 CVE-2026-109733 CVE-2026-109734 CVE-2026-109736 CVE-2026-109737 CVE-2026-109738 CVE-2026-109741 CVE-2026-109742 CVE-2026-109743 CVE-2026-109744 CVE-2026-109745 CVE-2026-109751 CVE-2026-109752 CVE-2026-109753 CVE-2026-109754 CVE-2026-109756 CVE-2026-109757 CVE-2026-109759 CVE-2026-109760 CVE-2026-109762 CVE-2026-109763 CVE-2026-109764 CVE-2026-109765 CVE-2026-109766 CVE-2026-109767 CVE-2026-109770 CVE-2026-109775 CVE-2026-109776 CVE-2026-109777 CVE-2026-109778 CVE-2026-109781 CVE-2026-109782 CVE-2026-109783}
+	[trixie] - firefox-esr 153.5.0esr-1~deb13u1
+[14 Oct 2026] DSA-6559-1 buildstream - security update
+	{CVE-2026-82331}
+	[trixie] - buildstream 1.6.9-2+deb13u1
 [14 Oct 2026] DSA-6558-1 curl - security update
 	{CVE-2026-8286 CVE-2026-8924 CVE-2026-8927 CVE-2026-92392}
 	[trixie] - curl 8.14.1-2+deb13u7


=====================================
data/dsa-needed.txt
=====================================
@@ -26,9 +26,6 @@ apache2
 bouncycastle
   possibly move to 1.85 for trixie
 --
-buildstream (jmm)
-  Maintainer can provide an update for review
---
 cacti
   probably best to move to 1.2.31
 --
@@ -52,8 +49,6 @@ firebird3.0
 --
 firebird4.0
 --
-firefox-esr (jmm)
---
 freerdp3 (jmm)
   Maintainer proposed a rebase to 3.31, cf. 37e52800-318b-4159-9aca-fda7e7ca1033 at tls.msk.ru
   Needs a followup for remina and gnome-remote-desktop via trixie-pu as well
@@ -161,10 +156,6 @@ shaarli
 --
 social-auth-core
 --
-sogo (jmm)
-  Regression update for #1144734, new batch of issues from 5.12.10 release
-  Peter Wienemann sent debdiff for review in <fce6b95f-9a6e-4bb3-9f76-1db94c748718 at debian.org>
---
 spip (carnil)
   David Prévot prepared an update in <03cfbefd-6103-42cf-8e51-b00c3d42f15b at tilapin.org>,
   wait for potential regressions



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0a954f3ca849a75be75b28adb49f26a9acc2edda

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0a954f3ca849a75be75b28adb49f26a9acc2edda
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261014/6d0f60d5/attachment-0001.htm>