[Git][security-tracker-team/security-tracker][master] trixie triage

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
1991b559 by Moritz Muehlenhoff at 2026-10-14T23:10:53+02:00
trixie triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -5039,10 +5039,11 @@ CVE-2026-109117
 	NOTE: https://oath-toolkit.codeberg.page/CVE-2026-109117.html
 	NOTE: Fixed by: https://codeberg.org/oath-toolkit/oath-toolkit/commit/5000be81a938a3bc01fb1a4636e89c19588ce7fb (v2.6.15)
 CVE-2026-XXXX [GHSA-48f2-29wv-5jgc: Exotic RainerScript replace() 32-bit output-length wrap causes a heap buffer overflow]
-	- rsyslog <unfixed>
+	- rsyslog <unfixed> (unimportant)
 	NOTE: https://www.openwall.com/lists/oss-security/2026/10/13/12
 	NOTE: https://github.com/rsyslog/rsyslog/security/advisories/GHSA-48f2-29wv-5jgc
 	NOTE: Fixed by: https://github.com/rsyslog/rsyslog/commit/0a6901dd6f4f3e6c99097179f1cfeb8e1820bcdc
+	NOTE: Negligible security impact
 CVE-2026-9218 (Insufficient input validation vulnerability in time server (NTP) setti ...)
 	NOT-FOR-US: Netgear
 CVE-2026-97334 (The network messaging layer contained improper handling of highly comp ...)
@@ -12921,17 +12922,20 @@ CVE-2026-106447 (StableLib is a stable library of useful TypeScript and JavaScri
 	NOT-FOR-US: StableLib
 CVE-2026-106446 (Handlebars provides the power necessary to let users build semantic te ...)
 	- node-handlebars 3:4.7.10-1 (bug #1150246)
+	[trixie] - node-handlebars <no-dsa> (Minor issue)
 	NOTE: https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj
 	NOTE: https://github.com/handlebars-lang/handlebars.js/pull/2185
 	NOTE: Fixed by: https://github.com/handlebars-lang/handlebars.js/commit/703fdcc5fd6cc8d1cc0c33cc19de40c467c4b8d2 (v4.7.10)
 	NOTE: CVE exists because of a bypass of CVE-2026-33937
 CVE-2026-106445 (Handlebars provides the power necessary to let users build semantic te ...)
 	- node-handlebars 3:4.7.10-1 (bug #1150246)
+	[trixie] - node-handlebars <no-dsa> (Minor issue)
 	NOTE: https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-p8wg-vrv2-v86f
 	NOTE: https://github.com/handlebars-lang/handlebars.js/pull/2185
 	NOTE: Fixed by: https://github.com/handlebars-lang/handlebars.js/commit/ceec388abe1d1aac8f6369860d5f390fa71ef4fa (v4.7.10)
 CVE-2026-106444 (Handlebars provides the power necessary to let users build semantic te ...)
 	- node-handlebars 3:4.7.10-1 (bug #1150246)
+	[trixie] - node-handlebars <no-dsa> (Minor issue)
 	NOTE: https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-xw65-4hp5-5hc7
 	NOTE: https://github.com/handlebars-lang/handlebars.js/pull/2185
 	NOTE: Fixed by: https://github.com/handlebars-lang/handlebars.js/commit/609d1b11c833c9a3e00f56f2f34d22f425446725 (v4.7.10)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1991b5592c20a2201c7a33699ddea7593967f9be

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1991b5592c20a2201c7a33699ddea7593967f9be
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261014/58efb243/attachment.htm>