[Git][security-tracker-team/security-tracker][master] trixie triage

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
cf956a1d by Moritz Muehlenhoff at 2026-10-17T20:55:45+02:00
trixie triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -105,6 +105,7 @@ CVE-2026-111823 (Mage OSS through 0.9.80 before 76c4f46 can proceed with session
 	NOT-FOR-US: Mage OSS
 CVE-2026-111802 (A flaw was found in Nautilus. When a removable drive or disk image is  ...)
 	- nautilus <unfixed>
+	[trixie] - nautilus <no-dsa> (Minor issue)
 	NOTE: https://gitlab.gnome.org/GNOME/nautilus/-/merge_requests/2179
 CVE-2026-111726 (The Themify Builder plugin for WordPress is vulnerable to Stored Cross ...)
 	NOT-FOR-US: WordPress plugin
@@ -1319,12 +1320,13 @@ CVE-2026-104745 (The Customer Email Verification for WooCommerce plugin for Word
 CVE-2026-104730 (The Sunshine Photo Cart \u2013 Client Photo Gallery & Photo Proofing f ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-104198 (ZoneMinder is a free, open source closed-circuit television software a ...)
-	- zoneminder <unfixed>
+	- zoneminder <unfixed> (unimportant)
 	NOTE: https://github.com/ZoneMinder/zoneminder/security/advisories/GHSA-23fj-frfw-hmcr
 	NOTE: Fixed by: https://github.com/ZoneMinder/zoneminder/commit/144a04ca4fff5fd02745ce8afc239ba5e05cf8ac
 	NOTE: Fixed by: https://github.com/ZoneMinder/zoneminder/commit/6b94903e634fdb46cb71a48eadccf1aa14f0c2bb
 	NOTE: Fixed by: https://github.com/ZoneMinder/zoneminder/commit/71bb186b230dbe2aba5e2f804c36810aae892088 (1.38.4)
 	NOTE: Fixed by: https://github.com/ZoneMinder/zoneminder/commit/d71fbb805e4695a9599498a1a2ee3b286ef41c96 (1.38.4)
+	NOTE: Only supported for trusted users/behind auth
 CVE-2026-104001 (The The Slim SEO \u2013 AI SEO Plugin, Lightweight, Fast & Automated p ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-104000 (The Simply Schedule Appointments plugin for WordPress is vulnerable to ...)
@@ -3145,9 +3147,10 @@ CVE-2026-110608 (BizSpring Shop through commit cf22d39daaf1 contains an insecure
 CVE-2026-110607 (BizSpring Shop through commit cf22d39daaf1 contains a payment verifica ...)
 	NOT-FOR-US: BizSpring Shop
 CVE-2026-110606 (LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains  ...)
-	- librecad <unfixed>
+	- librecad <unfixed> (unimportant)
 	NOTE: librecad bundles libdxfrw
 	NOTE: https://github.com/LibreCAD/LibreCAD/issues/2554
+	NOTE: Crash in CLI tool, no security impact
 CVE-2026-110605 (libschrift through 0.10.2 contains a divide by zero vulnerability that ...)
 	NOT-FOR-US: libschrift
 CVE-2026-110604 (Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bound ...)
@@ -3161,6 +3164,7 @@ CVE-2026-110602 (libmspack through 0.11alpha contains an uninitialized pointer f
 	NOTE: https://github.com/kyz/libmspack/commit/4d868504114346aa767d435fbb89a8b76603493f
 CVE-2026-110601 (libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out- ...)
 	- libsixel 1:1.8.7-r2-1
+	[trixie] - libsixel <no-dsa> (Minor issue)
 	NOTE: https://github.com/saitoha/libsixel/issues/220
 	NOTE: Fixed by: https://github.com/saitoha/libsixel/commit/bdbab09816eb9188429c37a50b97c5e66dfe5047 (v1.8.7-r1)
 CVE-2026-110600 (xlsxio through 0.2.37 contains a NULL pointer dereference vulnerabilit ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cf956a1d7525da01501a8cf84f2e4d2cea5b0c66

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cf956a1d7525da01501a8cf84f2e4d2cea5b0c66
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261017/74561d2d/attachment.htm>