[Git][security-tracker-team/security-tracker][master] Add more MariaDB issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Sat Oct 17 09:44:33 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
3668d221 by Salvatore Bonaccorso at 2026-10-17T10:43:42+02:00
Add more MariaDB issues
- - - - -
2 changed files:
- data/CVE/list
- data/next-point-update.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -216,7 +216,11 @@ CVE-2026-92766 (The Vitepos \u2013 Point of Sale (POS) for WooCommerce plugin fo
CVE-2026-92263 (SparkyFitness is a self-hosted, AI-powered health and fitness tracker ...)
NOT-FOR-US: SparkyFitness
CVE-2026-92262 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
- TODO: check
+ - mariadb 1:11.8.9+ds-1
+ NOTE: https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h
+ NOTE: https://jira.mariadb.org/browse/MDEV-40362
+ NOTE: Fixed by: https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb (mariadb-13.1.1, mariadb-13.0.2, mariadb-12.3.3, mariadb-11.8.9, mariadb-11.4.13, mariadb-10.11.19, mariadb-10.6.28)
+ NOTE: Fixed by: https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e (mariadb-13.1.1, mariadb-13.0.2, mariadb-12.3.3, mariadb-11.8.9, mariadb-11.4.13, mariadb-10.11.19, mariadb-10.6.28)
CVE-2026-90821 (An input neutralization vulnerability in the Webhook URL form field co ...)
NOT-FOR-US: Crafty Controller
CVE-2026-89098 (A flaw was found in nfs-utils. The fsidd daemon improperly handles inp ...)
@@ -226,19 +230,39 @@ CVE-2026-88755 (Z.ai ZCode v3.11.2.6792 was discovered to automatically establis
CVE-2026-87111 (The User Registration PRO \u2013 Custom Registration Form, Login Form, ...)
NOT-FOR-US: WordPress plugin
CVE-2026-86047 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
- TODO: check
+ - mariadb 1:11.8.9+ds-1
+ NOTE: https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p
+ NOTE: https://jira.mariadb.org/browse/MDEV-39776
+ NOTE: https://jira.mariadb.org/browse/MDEV-39818
+ NOTE: https://jira.mariadb.org/browse/MDEV-40308
+ NOTE: https://jira.mariadb.org/browse/MDEV-40311
+ NOTE: https://jira.mariadb.org/browse/MDEV-40312
+ NOTE: Fixed by: https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52 (mariadb-13.1.1, mariadb-13.0.2, mariadb-12.3.3, mariadb-11.8.9, mariadb-11.4.13, mariadb-10.11.19, mariadb-10.6.28)
+ NOTE: Fixed by: https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5 (mariadb-13.1.1, mariadb-13.0.2, mariadb-12.3.3, mariadb-11.8.9, mariadb-11.4.13, mariadb-10.11.19, mariadb-10.6.28)
+ NOTE: Fixed by: https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a (mariadb-13.1.1, mariadb-13.0.2, mariadb-12.3.3, mariadb-11.8.9, mariadb-11.4.13, mariadb-10.11.19, mariadb-10.6.28)
+ NOTE: Fixed by: https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513 (mariadb-13.1.1, mariadb-13.0.2, mariadb-12.3.3, mariadb-11.8.9, mariadb-11.4.13, mariadb-10.11.19, mariadb-10.6.28)
+ NOTE: Fixed by: https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b (mariadb-13.1.1, mariadb-13.0.2, mariadb-12.3.3, mariadb-11.8.9, mariadb-11.4.13, mariadb-10.11.19, mariadb-10.6.28)
CVE-2026-86009 (Mailu is a mail server distributed as a set of Docker images. Prior to ...)
NOT-FOR-US: Mailu
CVE-2026-86008 (Mailu is a mail server distributed as a set of Docker images. Prior to ...)
NOT-FOR-US: Mailu
CVE-2026-85985 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
- TODO: check
+ - mariadb 1:11.8.9+ds-1
+ NOTE: https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6
+ NOTE: https://jira.mariadb.org/browse/MDEV-40323
+ NOTE: Fixed by: https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe (mariadb-13.1.1, mariadb-13.0.2, mariadb-12.3.3, mariadb-11.8.9, mariadb-11.4.13, mariadb-10.11.19, mariadb-10.6.28)
CVE-2026-85977 (A flaw was found in libtirpc. A remote attacker can exploit this vulne ...)
TODO: check
CVE-2026-85748 (MariaDB server is a community developed fork of MySQL server. From 12. ...)
- TODO: check
+ - mariadb <not-affected> (Vulnerable code not present)
+ NOTE: https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm
+ NOTE: https://jira.mariadb.org/browse/MDEV-40396
+ NOTE: https://jira.mariadb.org/browse/MDEV-40639
CVE-2026-85746 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
- TODO: check
+ - mariadb 1:11.8.9+ds-1
+ NOTE: https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx
+ NOTE: https://jira.mariadb.org/browse/MDEV-40329
+ NOTE: Fixed by: https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85 (mariadb-13.1.1, mariadb-13.0.2, mariadb-12.3.3, mariadb-11.8.9, mariadb-11.4.13, mariadb-10.11.19, mariadb-10.6.28)
CVE-2026-85745 (MariaDB server is a community developed fork of MySQL server. From 10. ...)
- mariadb 1:11.8.9+ds-1
NOTE: https://github.com/MariaDB/server/security/advisories/GHSA-p7v9-24h4-mch8
=====================================
data/next-point-update.txt
=====================================
@@ -264,6 +264,14 @@ CVE-2026-97380
[trixie] - mariadb 1:11.8.9+ds-0+deb13u1
CVE-2026-85745
[trixie] - mariadb 1:11.8.9+ds-0+deb13u1
+CVE-2026-92262
+ [trixie] - mariadb 1:11.8.9+ds-0+deb13u1
+CVE-2026-86047
+ [trixie] - mariadb 1:11.8.9+ds-0+deb13u1
+CVE-2026-85985
+ [trixie] - mariadb 1:11.8.9+ds-0+deb13u1
+CVE-2026-85746
+ [trixie] - mariadb 1:11.8.9+ds-0+deb13u1
CVE-2026-9323
[trixie] - urwid 2.6.16-1+deb13u1
CVE-2026-75895
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3668d221ebffc3fffd754674be31b6a169dee0a0
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3668d221ebffc3fffd754674be31b6a169dee0a0
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261017/f50edc96/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list