[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues

Sun Oct 18 08:16:58 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f10d135b by Salvatore Bonaccorso at 2026-10-18T09:16:32+02:00
Add Debian bug references for various issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -918,13 +918,13 @@ CVE-2026-106705 (ELADMIN (eladmin-mp) up to 2.7 contains an improper access cont
 CVE-2026-106030 (NordVPN for Windows allows local attackers to stop unprotected Windows ...)
 	NOT-FOR-US: NordVPN for Windows
 CVE-2026-105959 (A flaw was found in spice-server. The GLZ encoder dictionary restore p ...)
-	- spice <unfixed>
+	- spice <unfixed> (bug #1151202)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2554008
 	NOTE: https://gitlab.freedesktop.org/spice/spice/-/merge_requests/253
 	NOTE: https://gitlab.freedesktop.org/spice/spice/-/commit/a3b9feb121fa6b19dc55cca6ec546e35fe4c9573
 	NOTE: https://gitlab.freedesktop.org/spice/spice/-/commit/4807b923d09e656d3f414ccde16d83189ba79ac9
 CVE-2026-105958 (A flaw was found in spice-server. Multiple migration data handlers use ...)
-	- spice <unfixed>
+	- spice <unfixed> (bug #1151201)
 	NOTE: https://gitlab.freedesktop.org/spice/spice/-/merge_requests/257
 CVE-2026-105667 (In the default configuration, the HL7 listener accepts ADT^A40 patient ...)
 	NOT-FOR-US: dcm4chee-arc-light
@@ -2218,7 +2218,7 @@ CVE-2026-102946 (joserfc is a Python library that provides an implementation of
 	NOTE: https://github.com/authlib/joserfc/security/advisories/GHSA-4pp3-559j-c5c2
 	NOTE: Fixed by: https://github.com/authlib/joserfc/commit/f409f8f058225d7686acab6546c94593e4c1bfbe (1.7.4)
 CVE-2026-102740 (The AsyncHttpClient library allows Java applications to execute HTTP r ...)
-	- async-http-client <unfixed>
+	- async-http-client <unfixed> (bug #1151205)
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/security/advisories/GHSA-cf59-3jcr-vfhw
 	NOTE: https://github.com/AsyncHttpClient/async-http-client/pull/2281
 	NOTE: Fixed by: https://github.com/AsyncHttpClient/async-http-client/commit/0422e11c954c4b026e986d1458f7a7a2eab7e591 (async-http-client-project-2.16.1)
@@ -2288,17 +2288,17 @@ CVE-2026-100350 (kin-openapi is a Go project for handling OpenAPI files. From 0.
 	NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-h4r5-mxv5-8mjc
 	NOTE: https://github.com/getkin/kin-openapi/commit/d090e36b2f1c42c898ba2a687a8f6e25f5ca727f (v0.146.0)
 CVE-2026-100349 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146 ...)
-	- golang-github-getkin-kin-openapi <unfixed>
+	- golang-github-getkin-kin-openapi <unfixed> (bug #1151207)
 	[trixie] - golang-github-getkin-kin-openapi <no-dsa> (Minor issue)
 	NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-74vm-87hj-r66f
 	NOTE: https://github.com/getkin/kin-openapi/commit/f5441d67f855ed34d975b3b85665764644ab1459 (v0.146.0)
 CVE-2026-100348 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145 ...)
-	- golang-github-getkin-kin-openapi <unfixed>
+	- golang-github-getkin-kin-openapi <unfixed> (bug #1151207)
 	[trixie] - golang-github-getkin-kin-openapi <no-dsa> (Minor issue)
 	NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-mh7x-f8wq-4jhx
 	NOTE: https://github.com/getkin/kin-openapi/commit/88aa64c7cbd03ecadbb419c473bdcaa8b0124c6b (v0.145.0)
 CVE-2026-100347 (kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145 ...)
-	- golang-github-getkin-kin-openapi <unfixed>
+	- golang-github-getkin-kin-openapi <unfixed> (bug #1151207)
 	[trixie] - golang-github-getkin-kin-openapi <no-dsa> (Minor issue)
 	NOTE: https://github.com/getkin/kin-openapi/security/advisories/GHSA-fh4f-47mf-f2gj
 	NOTE: https://github.com/getkin/kin-openapi/commit/f1a5b523b82868d2d9be2e116b4e942892be72c3 (v0.145.0)
@@ -3526,7 +3526,7 @@ CVE-2026-103974 (lichess.org is the forever free, adless and open source chess s
 CVE-2026-103946 (An SQL injection vulnerability could allow an authenticated user to re ...)
 	NOT-FOR-US: Tenable
 CVE-2026-103930 (cpp-httplib is a C++ header-only HTTP/HTTPS library. From 0.29.0 until ...)
-	- cpp-httplib <unfixed>
+	- cpp-httplib <unfixed> (bug #1151203)
 	NOTE: https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-vq69-f637-8fhr
 	NOTE: https://github.com/yhirose/cpp-httplib/pull/2501
 	NOTE: Fixed by: https://github.com/yhirose/cpp-httplib/commit/255c075b82cf9f221e6e607e8e6789e6e2bf4c2a (v0.51.0)
@@ -3557,7 +3557,7 @@ CVE-2026-103308 (The Visma Pay for WooCommerce WordPress plugin before 1.2.2 doe
 CVE-2026-103081 (Improper Control of Generation of Code ('Code Injection') vulnerabilit ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-102944 (cpp-httplib is a C++ header-only HTTP/HTTPS library. Prior to 0.51.0,  ...)
-	- cpp-httplib <unfixed>
+	- cpp-httplib <unfixed> (bug #11512034)
 	NOTE: https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-22mf-w2v3-r2jv
 	NOTE: Fixed by: https://github.com/yhirose/cpp-httplib/commit/0c1cc8c9866bb567ff11c1cd0d09779e8c5f8585 (v0.51.0)
 CVE-2026-102899 (Sentry is an application monitoring and error tracking platform. From  ...)
@@ -6975,7 +6975,7 @@ CVE-2026-110453 (Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorr
 	NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
 	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-92x5-h528-wrmw
 CVE-2026-110452 (The multi-user installer in Nix before 2.35.3 sets the ownership of st ...)
-	- nix <unfixed>
+	- nix <unfixed> (bug #1151197)
 	NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
 	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-hf6w-2rg9-v84g
 CVE-2026-110451 (Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sand ...)
@@ -6984,11 +6984,11 @@ CVE-2026-110451 (Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbe
 	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-m4vq-qf6v-82pj
 	NOTE: scripts/install-multi-user.sh is removed from the orig tarball since 2.16.1+dfsg-1
 CVE-2026-110450 (Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via ...)
-	- nix <unfixed>
+	- nix <unfixed> (bug #1151197)
 	NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
 	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-jwvx-xq5j-gc56
 CVE-2026-110449 (Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and r ...)
-	- nix <unfixed>
+	- nix <unfixed> (bug #1151197)
 	NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
 	NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-25vp-6h23-hj3g
 CVE-2026-110447 (Collabora Online Built-in CODE Server before 26.4.303 (richdocumentsco ...)
@@ -9770,7 +9770,7 @@ CVE-2026-14552 (GitLab has remediated an issue in GitLab CE/EE affecting all ver
 CVE-2026-14210 (GitLab has remediated an issue in GitLab CE/EE affecting all versions  ...)
 	NOT-FOR-US: GitLab (used to be packaged in the Debian archive as src:gitlab, but never in a stable release)
 CVE-2026-109786 (In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (conf ...)
-	- fail2ban <unfixed>
+	- fail2ban <unfixed> (bug #1151199)
 	[trixie] - fail2ban <no-dsa> (Minor issue)
 	[bookworm] - fail2ban <postponed> (Minor issue)
 	NOTE: Fixed by: https://github.com/fail2ban/fail2ban/commit/ddd879d22664904ace24e1255ac6571808c58187
@@ -11342,7 +11342,7 @@ CVE-2026-108985 (ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-
 CVE-2026-108982 (VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended  ...)
 	NOT-FOR-US: VeraCrypt
 CVE-2026-108981 (ngx_cache_purge before 3.0.4 can allow file deletion via a symlink att ...)
-	- libnginx-mod-http-cache-purge <unfixed>
+	- libnginx-mod-http-cache-purge <unfixed> (bug #1151200)
 	NOTE: https://github.com/nginx-modules/ngx_cache_purge/pull/72
 	NOTE: Fixed by: https://github.com/nginx-modules/ngx_cache_purge/commit/a6da1352f52a8a02dd6828e88c39ed42fddcee96 (3.0.4)
 CVE-2026-108980 (Blinko through 1.8.8 allows directory traversal, overwriting startup f ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f10d135bf2343325b21a5e69b7c636442b96524a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f10d135bf2343325b21a5e69b7c636442b96524a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261018/b63fd88e/attachment.htm>
