[Git][security-tracker-team/security-tracker][master] One libmatio CVE finally rejected

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8ca6ce6e by Salvatore Bonaccorso at 2026-10-21T19:17:58+02:00
One libmatio CVE finally rejected

- - - - -


2 changed files:

- data/CVE/list
- data/DLA/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -242692,15 +242692,8 @@ CVE-2025-56332 (Authentication Bypass in fosrl/pangolin v1.6.2 and before allows
 	NOT-FOR-US: fosrl/pangolin
 CVE-2025-52835 (Cross-Site Request Forgery (CSRF) vulnerability in ConoHa by GMO WING  ...)
 	NOT-FOR-US: WordPress plugin or theme
-CVE-2025-50343 (An issue was discovered in matio 1.5.28. A heap-based memory corruptio ...)
-	{DLA-4644-1 DLA-4459-1}
-	[experimental] - libmatio 1.5.30-1
-	- libmatio 1.5.30-2 (bug #1124797; unimportant)
-	NOTE: https://github.com/tbeu/matio/issues/275
-	NOTE: Fixed by: https://github.com/tbeu/matio/commit/41b505410dafaa236b61b52c7910d4c4831404f2
-	NOTE: https://github.com/tbeu/matio/issues/275#issuecomment-5821819184
-	NOTE: CVE is disputed, the error is on the caller side, maintainer only hanged the
-	NOTE: API to Mat_VarCreateStruct2().
+CVE-2025-50343
+	REJECTED
 CVE-2025-15359 (DVP-12SE11T - Out-of-bound memory write Vulnerability)
 	NOT-FOR-US: Delta Electronics
 CVE-2025-15358 (DVP-12SE11T - Denial of Service Vulnerability)


=====================================
data/DLA/list
=====================================
@@ -652,7 +652,7 @@
 [24 Jun 2026] DLA-4645-1 cloud-init - security update
 	[bullseye] - cloud-init 20.4.1-2+deb11u2
 [24 Jun 2026] DLA-4644-1 libmatio - security update
-	{CVE-2025-2337 CVE-2025-2338 CVE-2025-50343}
+	{CVE-2025-2337 CVE-2025-2338}
 	[bookworm] - libmatio 1.5.23-2+deb12u1
 [23 Jun 2026] DLA-4643-1 imagemagick - security update
 	{CVE-2026-48733 CVE-2026-48734 CVE-2026-48994 CVE-2026-49218 CVE-2026-53460 CVE-2026-53463}
@@ -1206,7 +1206,7 @@
 	{CVE-2022-0670 CVE-2024-47866}
 	[bullseye] - ceph 14.2.21-1+deb11u2
 [29 Jan 2026] DLA-4459-1 libmatio - security update
-	{CVE-2022-1515 CVE-2025-2338 CVE-2025-50343}
+	{CVE-2022-1515 CVE-2025-2338}
 	[bullseye] - libmatio 1.5.19-2+deb11u1
 [28 Jan 2026] DLA-4458-1 python-django - security update
 	{CVE-2024-39329 CVE-2024-39330 CVE-2024-39614 CVE-2024-41989 CVE-2024-41991 CVE-2024-42005 CVE-2024-45231}



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8ca6ce6ecddcdb4a9aa12fb30ffdcb9c172479fa

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8ca6ce6ecddcdb4a9aa12fb30ffdcb9c172479fa
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261021/b8c3d7fa/attachment.htm>