[Git][security-tracker-team/security-tracker][master] Add CVe-2026-92287/apache-arrow

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f1f84bd8 by Salvatore Bonaccorso at 2026-10-23T10:23:12+02:00
Add CVe-2026-92287/apache-arrow

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -6122,7 +6122,10 @@ CVE-2026-92449 (`_gx_binres_pixelmap_table_load()` in the GUIX binary resource (
 CVE-2026-92446 (`gx_binres_theme_load()` and `gx_binres_font_load()` take the resource ...)
 	NOT-FOR-US: Eclipse
 CVE-2026-92287 (Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parq ...)
-	TODO: check
+	- apache-arrow <unfixed>
+	NOTE: https://lists.apache.org/thread/0t6vry0msbk9dpsd0xv395ov5b84hj57
+	NOTE: https://github.com/apache/arrow/issues/51349
+	NOTE: https://github.com/apache/arrow/pull/51350 (apache-arrow-26.0.0-rc0)
 CVE-2026-91189 (The GUIX binary resource loader never checks that a font page's glyph  ...)
 	NOT-FOR-US: Eclipse
 CVE-2026-91186 (The PNG chunk reader has no notion of chunk ordering. It records wheth ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f1f84bd849cf2113cf329a6571b04086e0e80d07

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f1f84bd849cf2113cf329a6571b04086e0e80d07
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/c594d05f/attachment.htm>