[Git][security-tracker-team/security-tracker][master] new lomiri-[up|down]load-manager issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
07d619ca by Moritz Muehlenhoff at 2026-10-16T23:20:23+02:00
new lomiri-[up|down]load-manager issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -11,9 +11,18 @@ CVE-2026-96870 (The SureDash \u2013 Community, Courses & Member Dashboard plugin
 CVE-2026-96768 (The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-96425 (Incorrect DBus policy for lomiri-download-manager allows arbitrary use ...)
-	TODO: check
+	- lomiri-download-manager 0.3.3-1
+	[trixie] - lomiri-download-manager <no-dsa> (Minor issue)
+	NOTE: https://gitlab.com/ubports/development/core/lomiri-download-manager/-/work_items/17
+	NOTE: https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/5fd50939a3cacef4181f6bcb58796bdcbc17984d (0.3.3)
+	NOTE: https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/779dfd5bbeb5fe8877627b772e5024e40eda38aa (0.3.3)
+	NOTE: https://forums.ubports.com/topic/12671/security-advisory-arbitrary-root-command-execution-and-unauthenticated-arbitrary-file-read-as-root-in-lomiri-download-manager
 CVE-2026-96424 (Incorrect DBus policy for lomiri-upload-manager (part of lomiri-downlo ...)
-	TODO: check
+	- lomiri-upload-manager 0.3.3-1
+	[trixie] - lomiri-upload-manager <no-dsa> (Minor issue)
+	NOTE: https://gitlab.com/ubports/development/core/lomiri-download-manager/-/work_items/18
+	NOTE: https://gitlab.com/ubports/development/core/lomiri-download-manager/-/commit/779dfd5bbeb5fe8877627b772e5024e40eda38aa
+	NOTE: https://forums.ubports.com/topic/12671/security-advisory-arbitrary-root-command-execution-and-unauthenticated-arbitrary-file-read-as-root-in-lomiri-download-manager
 CVE-2026-95859 (libp2p-rust is the official Rust language implementation of the libp2p ...)
 	NOT-FOR-US: libp2p-rust
 CVE-2026-95183 (An issue in the context-compaction feature of DeepSeek Harness (dsh) c ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/07d619cadedc4acce1c1f6744b11acf0a86d0f23

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/07d619cadedc4acce1c1f6744b11acf0a86d0f23
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261016/2a598b3e/attachment.htm>