[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Sat Oct 17 22:48:41 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
85c14076 by Moritz Muehlenhoff at 2026-10-17T23:47:38+02:00
trixie triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1540,9 +1540,11 @@ CVE-2026-88753 (A Regular-Expression Denial of Service (ReDoS) in the Markdown2.
NOTE: https://gist.github.com/NanaSec/354b4188bbd7f4105008c7b8be49b0ba
CVE-2026-87029 (undici is an HTTP client library for Node.js. In versions 7.15.0 throu ...)
- node-undici 8.12.2+dfsg+~cs3.2.3-1
+ [trixie] - node-undici <no-dsa> (Minor issue)
NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-55wc-3pg8-jfw6
CVE-2026-87018 (undici is an HTTP client library for Node.js. In versions 4.2.1 throug ...)
- node-undici 8.12.2+dfsg+~cs3.2.3-1
+ [trixie] - node-undici <no-dsa> (Minor issue)
NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-qrxm-fqhp-jwvm
CVE-2026-85634 (A flaw was found in the ContentRepositoryImpl.copyExplodedContent func ...)
- wildfly <itp> (bug #752018)
@@ -2034,9 +2036,11 @@ CVE-2026-110360 (Missing Authorization vulnerability in WPdreams Ajax Search Lit
NOT-FOR-US: WordPress plugin or theme
CVE-2026-109932 (undici is an HTTP client library for Node.js. In versions 5.15.0 throu ...)
- node-undici 8.12.2+dfsg+~cs3.2.3-1
+ [trixie] - node-undici <no-dsa> (Minor issue)
NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-9fm3-97px-rjf6
CVE-2026-109924 (undici is an HTTP client library for Node.js. In versions 6.5.0 throug ...)
- node-undici 8.12.2+dfsg+~cs3.2.3-1
+ [trixie] - node-undici <no-dsa> (Minor issue)
NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-4qv8-2p9j-2685
CVE-2026-109897 (Missing Authorization vulnerability in WP Chill Strong Testimonials st ...)
NOT-FOR-US: WordPress plugin or theme
@@ -2046,6 +2050,7 @@ CVE-2026-109892 (Incorrect Privilege Assignment vulnerability in Shabti Kaplan F
NOT-FOR-US: WordPress plugin or theme
CVE-2026-109869 (undici is an HTTP client library for Node.js. In versions 6.23.0 throu ...)
- node-undici 8.12.2+dfsg+~cs3.2.3-1
+ [trixie] - node-undici <no-dsa> (Minor issue)
NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-xjj6-f33q-929c
CVE-2026-109855 (undici is an HTTP client library for Node.js. In versions 8.11.0 and 8 ...)
- node-undici 8.12.2+dfsg+~cs3.2.3-1
@@ -2054,9 +2059,11 @@ CVE-2026-109855 (undici is an HTTP client library for Node.js. In versions 8.11.
NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-qq8j-7v2v-3rwp
CVE-2026-109841 (undici is an HTTP client library for Node.js. In versions 7.15.0 throu ...)
- node-undici 8.12.2+dfsg+~cs3.2.3-1
+ [trixie] - node-undici <no-dsa> (Minor issue)
NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-f72v-6w45-q472
CVE-2026-109829 (undici is an HTTP client library for Node.js. In versions 7.0.0 throug ...)
- node-undici 8.12.2+dfsg+~cs3.2.3-1
+ [trixie] - node-undici <no-dsa> (Minor issue)
NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-4w7w-5xrc-9h26
CVE-2026-109702 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
@@ -2566,6 +2573,7 @@ CVE-2026-110840 (n8n before 2.41.4 and 2.42.x before 2.42.1 contains an SQL inje
NOT-FOR-US: n8n
CVE-2026-110816 (### Summary `qs.stringify` with `arrayFormat: 'comma'` throws `Type ...)
- node-qs <unfixed> (bug #1151084)
+ [trixie] - node-qs <no-dsa> (Minor issue)
NOTE: https://github.com/ljharb/qs/security/advisories/GHSA-6pq8-jhm2-2vcw
NOTE: https://github.com/ljharb/qs/commit/a952e7519338ef0cfb25694a2988848f93333727 (v6.16.1)
CVE-2026-110810 (A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4. This ...)
@@ -3493,11 +3501,12 @@ CVE-2026-104141 (DataEase is an open source data visualization and analysis tool
CVE-2026-104103 (Ludwig is a low-code framework for building custom LLMs, neural networ ...)
NOT-FOR-US: Ludwig
CVE-2026-104086 (7-Zip before 26.03 contains an uninitialized memory disclosure vulnera ...)
- - 7zip 26.03+dfsg-1
- - p7zip 16.02+transitional.1
+ - 7zip 26.03+dfsg-1 (unimportant)
+ - p7zip 16.02+transitional.1 (unimportant)
NOTE: Since p7zip/16.02+transitional.1 src:p7zip is only an empty source package
NOTE: depending on 7zip. Mark this version as fixed version.
NOTE: https://sourceforge.net/p/sevenzip/discussion/45797/thread/db6922e1d0/
+ NOTE: Crosses no security boundary
CVE-2026-103994 (A Heap-based Buffer Overflow vulnerability in theVXLAN Gateway Daemon( ...)
NOT-FOR-US: Juniper
CVE-2026-103993 (An Out-of-bounds Write vulnerability in the routing protocol daemon (r ...)
@@ -8472,6 +8481,7 @@ CVE-2026-109957 (EspoCRM before 10.0.7 contains an insecure direct object refere
NOT-FOR-US: EspoCRM
CVE-2026-109956 (NLTK through 3.10.3 contains a path traversal vulnerability in WekaCla ...)
- nltk <unfixed> (bug #1150904)
+ [trixie] - nltk <no-dsa> (Minor issue)
NOTE: https://github.com/nltk/nltk/security/advisories/GHSA-j456-xh4h-cpf2
NOTE: https://github.com/nltk/nltk/pull/3863
NOTE: https://github.com/nltk/nltk/commit/6a17606293fe9d3ea1006f99dd3fed2e2b25d519
@@ -10884,6 +10894,7 @@ CVE-2026-108168 (Improper Neutralization of Input During Web Page Generation ('C
NOT-FOR-US: WordPress plugin or theme
CVE-2026-108094 (A use-after-free flaw was found in mutter in the Wayland color-managem ...)
- mutter 50.5-1 (bug #1150932)
+ [trixie] - mutter <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2549511
NOTE: https://gitlab.gnome.org/GNOME/mutter/-/issues/5025
NOTE: https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/5313
@@ -10923,10 +10934,12 @@ CVE-2026-106605 (Improper Validation of Specified Quantity in Input vulnerabilit
CVE-2026-105668 (Protection Mechanism Failure vulnerability in hexpm hex allows the own ...)
[experimental] - erlang-hex 2.5.3-1
- erlang-hex <unfixed>
+ [trixie] - erlang-hex <not-affected> (Vulnerable code not present, only affects 2.5)
NOTE: https://github.com/hexpm/hex/security/advisories/GHSA-pqhp-5x9x-69h7
NOTE: https://cna.erlef.org/cves/CVE-2026-105668.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-105668
- NOTE: https://github.com/hexpm/hex/commit/eed2bdf85320ae9e244629511c03f5f3f8c5d0b5 (v2.5.2)
+ NOTE: Fixed by: https://github.com/hexpm/hex/commit/eed2bdf85320ae9e244629511c03f5f3f8c5d0b5 (v2.5.2)
+ NOTE: Introduced by: https://github.com/hexpm/hex/commit/b4e665d46be8a5f81e8cbbe4c3a67058a19cf133 (v2.5.0)
CVE-2026-105466 (IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable ...)
NOT-FOR-US: IBM
CVE-2026-105465 (IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 isvulnerable ...)
@@ -10950,6 +10963,7 @@ CVE-2026-105283 (Generation of Error Message Containing Sensitive Information vu
CVE-2026-105280 (Improper Validation of Integrity Check Value vulnerability in hexpm he ...)
[experimental] - erlang-hex 2.5.3-1
- erlang-hex <unfixed>
+ [trixie] - erlang-hex <no-dsa> (Minor issue)
NOTE: https://github.com/hexpm/hex/security/advisories/GHSA-98jr-23pm-vj7c
NOTE: https://cna.erlef.org/cves/CVE-2026-105280.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-105280
@@ -11005,17 +11019,19 @@ CVE-2026-103521 (In Thelia v2.6.0, the document upload endpoint properly blocks
CVE-2026-103503 (Improper Certificate Validation vulnerability in hexpm hex allows an a ...)
[experimental] - erlang-hex 2.5.3-1
- erlang-hex <unfixed>
+ [trixie] - erlang-hex <no-dsa> (Minor issue)
NOTE: https://github.com/hexpm/hex/security/advisories/GHSA-rw8q-hg7m-cxgr
NOTE: https://cna.erlef.org/cves/CVE-2026-103503.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-103503
NOTE: Introduced with: https://github.com/hexpm/hex/commit/c9b26a46928bfcd546773571e09c1d05f4cd9fb7 (v0.20.2)
NOTE: Fixed by: https://github.com/hexpm/hex/commit/5f5a2136c7cf5991b6e8a30d645ca9f8e74b0785 (v2.5.2)
CVE-2026-103502 (Improper Certificate Validation vulnerability in hexpm hex_core allows ...)
- - erlang-hex <unfixed>
+ - erlang-hex <unfixed> (unimportant)
NOTE: https://github.com/hexpm/hex_core/security/advisories/GHSA-p26c-h8c2-rwqj
NOTE: https://cna.erlef.org/cves/CVE-2026-103502.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-103502
NOTE: https://github.com/hexpm/hex_core/commit/b7b3a42defb4ed8e20a5c68a4412ce68a95b7938 (v0.20.0)
+ NOTE: All Debian versions with erlang-hex have OTP 27 or later
CVE-2026-103356 (Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshippi ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-103080 (External Control of Assumed-Immutable Web Parameter vulnerability in V ...)
@@ -16239,6 +16255,7 @@ CVE-2026-91140 (An OS command injection vulnerability in the shell-based tempora
NOT-FOR-US: Progress Software
CVE-2026-88252 (A flaw was found in sssd. A local user can cause a Denial of Service ( ...)
- sssd <unfixed> (bug #1150238)
+ [trixie] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479240
CVE-2026-86362 (Dell System Update, versions prior to 2.3.0.0, contains an Improper Ac ...)
NOT-FOR-US: Dell / EMC
@@ -21331,16 +21348,14 @@ CVE-2026-73976 (djehuty is a research data repository system developed by 4TU.Re
CVE-2026-73975 (djehuty is a research data repository system developed by 4TU.Research ...)
NOT-FOR-US: djehuty
CVE-2026-68496 (The Smile parser in FasterXML jackson-dataformats-binary never invokes ...)
- - jackson-dataformat-smile <unfixed>
+ - jackson-dataformat-smile <not-affected> (Vulnerable code introduced later)
NOTE: https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-3v8f-v6vx-fmrm
NOTE: Fixed by: https://github.com/FasterXML/jackson-dataformats-binary/commit/8bbcac61fe35aedc71ae681915c99312f324eb65 (jackson-dataformats-binary-2.18.10)
- TODO: check, might not affect our ancient version
CVE-2026-68495 (The CBOR parser in FasterXML jackson-dataformats-binary never invokes ...)
- - jackson-dataformat-cbor <unfixed>
+ - jackson-dataformat-cbor <not-affected> (Vulnerable code introduced later)
NOTE: https://github.com/FasterXML/jackson-dataformats-binary/security/advisories/GHSA-3v8f-v6vx-fmrm
NOTE: https://github.com/FasterXML/jackson-dataformats-binary/issues/725
NOTE: Fixed by: https://github.com/FasterXML/jackson-dataformats-binary/commit/94ac96f950b685d076274426dadea902d59d6bf1 (jackson-dataformats-binary-2.18.10)
- TODO: check, night not affect our ancient version?
CVE-2026-67172 (HCL BigFix Service Management is affected by an Information Disclosure ...)
NOT-FOR-US: HCL
CVE-2026-67171 (HCL BigFix Service Management is affected by an Information Disclosure ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/85c14076cc0ff2effc0d69b74cd570ee4f86b8b3
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/85c14076cc0ff2effc0d69b74cd570ee4f86b8b3
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261017/afb874a0/attachment.htm>
More information about the debian-security-tracker-commits
mailing list