[Git][security-tracker-team/security-tracker][master] trixie triage

Sat Oct 17 12:34:32 BST 2026


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0afc5e29 by Moritz Muehlenhoff at 2026-10-17T13:33:16+02:00
trixie triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -71,9 +71,10 @@ CVE-2026-55796 (Frappe HR is an open-source human resources management solution
 CVE-2026-49410 (OpenHuman is an open-source agent harness available as a desktop appli ...)
 	NOT-FOR-US: OpenHuman
 CVE-2026-30971 (ZoneMinder is a free, open source closed-circuit television software a ...)
-	- zoneminder <unfixed>
+	- zoneminder <unfixed> (unimportant)
 	NOTE: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-g66m-77fq-79v9
 	NOTE: Fixed by: https://github.com/ZoneMinder/zoneminder/commit/419846c8750c3f45b9b8a1df8cd49c189a14dc03 (1.39.11)
+	NOTE: Only supported for trusted users/behind auth
 CVE-2026-17591 (A flaw was found in libarchive. An attacker can cause a Denial of Serv ...)
 	- libarchive 3.8.9-1
 	NOTE: https://github.com/libarchive/libarchive/pull/3318
@@ -296,6 +297,7 @@ CVE-2026-80092 (Authentication bypass by assumed-immutable data in Microsoft Ide
 	NOT-FOR-US: Microsoft
 CVE-2026-77630 (pupnp is an SDK for development of UPnP device and control point appli ...)
 	- pupnp <unfixed> (bug #1151082)
+	[trixie] - pupnp <no-dsa> (Minor issue)
 	NOTE: https://github.com/pupnp/pupnp/security/advisories/GHSA-46ph-jff5-5h77
 	NOTE: https://github.com/pupnp/pupnp/commit/5dba8070b4d64d976f8e6fc13f1f301befebe7d2 (release-22.0.4)
 CVE-2026-77474 (destructive_command_guard (dcg) is a command-line safety tool that blo ...)
@@ -326,14 +328,17 @@ CVE-2026-59962 (Tandoor Recipes is an application for managing recipes, planning
 	NOT-FOR-US: Tandoor Recipes
 CVE-2026-57488 (pupnp is an SDK for development of UPnP device and control point appli ...)
 	- pupnp <unfixed> (bug #1151082)
+	[trixie] - pupnp <no-dsa> (Minor issue)
 	NOTE: https://github.com/pupnp/pupnp/security/advisories/GHSA-g6c2-x4r9-352g
 	NOTE: https://github.com/pupnp/pupnp/commit/de9602aef34ff722f3630d66c9be8eaa0aa9f012 (release-2.0.2)
 CVE-2026-57487 (pupnp is an SDK for development of UPnP device and control point appli ...)
 	- pupnp <unfixed> (bug #1151082)
+	[trixie] - pupnp <no-dsa> (Minor issue)
 	NOTE: https://github.com/pupnp/pupnp/security/advisories/GHSA-gcj7-j9f7-q84c
 	NOTE: https://github.com/pupnp/pupnp/commit/9ff9bc583ad8ee4ba022634434a7b71db9bd96e1 (release-2.0.2)
 CVE-2026-57486 (pupnp is an SDK for development of UPnP device and control point appli ...)
 	- pupnp <unfixed> (bug #1151082)
+	[trixie] - pupnp <no-dsa> (Minor issue)
 	NOTE: https://github.com/pupnp/pupnp/security/advisories/GHSA-q54q-vx78-v9rq
 	NOTE: https://github.com/pupnp/pupnp/commit/4b2f775e3b98de3cfb096707bcde040c5562d9ec (release-2.0.2)
 CVE-2026-57447 (Discourse Doc Categories is a plugin for organizing Discourse topics a ...)
@@ -344,6 +349,7 @@ CVE-2026-57169 (Dockhand is a Docker management application. Prior to 1.0.34, th
 	NOT-FOR-US: Dockhand
 CVE-2026-55862 (pupnp is an SDK for development of UPnP device and control point appli ...)
 	- pupnp <unfixed> (bug #1151082)
+	[trixie] - pupnp <no-dsa> (Minor issue)
 	NOTE: https://github.com/pupnp/pupnp/security/advisories/GHSA-25cx-xv8x-j247
 	NOTE: https://github.com/pupnp/pupnp/commit/82ccaec7ab6b1258ea1ac66374d8940712ccd4c4 (release-2.0.0)
 CVE-2026-55836 (Open Zaak is an open-source data and services layer for Dutch case-ori ...)
@@ -679,6 +685,7 @@ CVE-2026-111581 (A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2554104
 CVE-2026-111555 (A flaw was found in luksmeta. Improper boundary validation of metadata ...)
 	- luksmeta <unfixed>
+	[trixie] - luksmeta <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2554026
 CVE-2026-111472 (An SQL injection vulnerability has been discovered in TSG Profleet. Th ...)
 	NOT-FOR-US: TSG Profleet
@@ -921,8 +928,9 @@ CVE-2026-15222 (The The User Registration & Membership \u2013 Free & Paid Member
 CVE-2026-12272 (The Lightweight Cookie Notice \u2013 Cookie Banner for Cookie Consent  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-111458 (The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates  ...)
-	- ssldump <unfixed>
+	- ssldump <unfixed> (unimportant)
 	NOTE: Fixed by: https://github.com/adulau/ssldump/commit/8ad55683cc0186600c085d33be5a5b627db78467
+	NOTE: Negligible security impact
 CVE-2026-111451 (Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes cal ...)
 	NOT-FOR-US: Wheels
 CVE-2026-111450 (Wheels through 4.1.1 derives its default production error-email addres ...)
@@ -2391,8 +2399,9 @@ CVE-2026-110809 (A security vulnerability has been detected in sgl-project SGLan
 CVE-2026-110807 (A weakness has been identified in sgl-project SGLang up to 0.5.19. Aff ...)
 	NOT-FOR-US: SGLang
 CVE-2026-110698 (A security vulnerability has been detected in Praat up to 7.0.02. Affe ...)
-	- praat <unfixed>
+	- praat <unfixed> (unimportant)
 	NOTE: https://github.com/praat/praat.github.io/issues/3348
+	NOTE: Crash in CLI/GUI tool, no security impact
 CVE-2026-110696 (A weakness has been identified in itsmeravitejak Online-Examination-Sy ...)
 	NOT-FOR-US: itsmeravitejak Online-Examination-System
 CVE-2026-110695 (A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affec ...)
@@ -2633,9 +2642,11 @@ CVE-2026-88998 (The Tickera WordPress plugin before 3.6.0.4 does not correctly v
 	NOT-FOR-US: WordPress plugin
 CVE-2026-88842 (A flaw was found in BusyBox dpkg. The write_status_file() function doe ...)
 	- busybox <unfixed>
+	[trixie] - busybox <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531355
 CVE-2026-88829 (A flaw was found in BusyBox httpd's reverse proxy feature. When the pr ...)
 	- busybox <unfixed>
+	[trixie] - busybox <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2531343
 CVE-2026-88164 (Missing authorization in Microsoft Office SharePoint allows an authori ...)
 	NOT-FOR-US: Microsoft
@@ -9701,6 +9712,7 @@ CVE-2026-109564 (LearnHouse before 1.4.0 contains a missing authorization vulner
 	NOT-FOR-US: LearnHouse
 CVE-2026-109563 (N3.js before 2.11.1 contains a regular expression denial of service vu ...)
 	- node-n3 <unfixed> (bug #1150935)
+	[trixie] - node-n3 <no-dsa> (Minor issue)
 	NOTE: https://github.com/rdfjs/N3.js/pull/760
 	NOTE: Fixed by: https://github.com/rdfjs/N3.js/commit/b1c497fddb02c4772d61916bd2634115f45f424d (v2.11.1)
 CVE-2026-109562 (SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulne ...)
@@ -13136,6 +13148,7 @@ CVE-2026-95209 (An issue in gnutls v3.8.13 causes legitimate CA certificates to
 	NOTE: Not considered security issues by GNU TLS upstream within the GNU TLS security policy
 CVE-2026-95208 (An issue in the ConfirmNameConstraints() function (wolfcrypt/src/asn.c ...)
 	- wolfssl <unfixed>
+	[trixie] - wolfssl <no-dsa> (Minor issue)
 	NOTE: https://github.com/lkloliver/poc/tree/main/CVE-2026-95208
 	TODO: check, valid assignment? https://gist.github.com/lkloliver/14edf8bbfbf5769949b85c7f5cc2eba2
 CVE-2026-95184 (Improper certificate validation in gnutls v3.8.13 causes the applicati ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0afc5e295d347798fbdc72c7ec8f3f275c90c8c8

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0afc5e295d347798fbdc72c7ec8f3f275c90c8c8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261017/07f25277/attachment.htm>
