[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Oct 23 20:17:24 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
7abaff18 by Moritz Muehlenhoff at 2026-10-23T21:14:48+02:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -1395,6 +1395,7 @@ CVE-2026-115328 (JSON-SCADA before 0.65-alpha contains an sql injection vulnerab
NOT-FOR-US: JSON-SCADA
CVE-2026-115327 (libyang through 6.4.13 contains an uninitialized pointer free vulnerab ...)
- libyang <unfixed>
+ [trixie] - libyang <no-dsa> (Minor issue)
- libyang2 <removed>
NOTE: https://github.com/CESNET/libyang/issues/2595
NOTE: Fixed by: https://github.com/CESNET/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773
@@ -1429,6 +1430,8 @@ CVE-2026-115221 (A flaw was found in FreeIPA. An improper authorization check al
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2559043
CVE-2026-115207 (A flaw was found in GNU patch. An attacker can achieve arbitrary file ...)
- patch <unfixed>
+ [trixie] - patch <no-dsa> (Minor issue)
+ NOTE: https://cgit.git.savannah.gnu.org/cgit/patch.git/commit/?id=0cd45bb2132a42cd38d84b20661f3eae9b4da7ce
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2558775
CVE-2026-114703 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
@@ -1552,9 +1555,11 @@ CVE-2026-114583 (tarfile.tar_filter could be bypassed using crafted link entries
- python3.15 <unfixed>
- python3.14 <unfixed>
- python3.13 <unfixed>
+ [trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <removed>
- jython <unfixed>
- pypy3 <unfixed>
+ [trixie] - pypy3 <no-dsa> (Minor issue)
NOTE: https://github.com/python/cpython/issues/160097
NOTE: https://github.com/python/cpython/pull/160098
NOTE: https://github.com/python/cpython/commit/e7e0b3523ad6ba8472873dda594cf4021a16f8b5 (main)
@@ -2614,12 +2619,14 @@ CVE-2026-113796 (Electron is a framework for writing cross-platform desktop appl
- electron <itp> (bug #842420)
CVE-2026-113795 (pypdf is a free and open-source pure-python PDF library. Prior to 6.20 ...)
- pypdf 6.21.0-1
+ [trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-7mh2-4gg2-979f
NOTE: https://github.com/py-pdf/pypdf/pull/4173
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/80a84d4be6022d910874ccb0d2365400f3f0e185 (6.20.0)
CVE-2026-113794 (pypdf is a free and open-source pure-python PDF library. Prior to 6.20 ...)
- pypdf 6.21.0-1
+ [trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-39mj-jf6j-2qj3
NOTE: https://github.com/py-pdf/pypdf/issues/4169
@@ -2627,30 +2634,35 @@ CVE-2026-113794 (pypdf is a free and open-source pure-python PDF library. Prior
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/37e1cd681744bac38b159f7e1c614eee8d639c58 (6.20.0)
CVE-2026-113793 (pypdf is a free and open-source pure-python PDF library. Prior to 6.20 ...)
- pypdf 6.21.0-1
+ [trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-9mx8-4j7g-633p
NOTE: https://github.com/py-pdf/pypdf/pull/4188
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/c9c35b4471c2eb5fe078094f6c816e69d4ed25a0 (6.20.1)
CVE-2026-113792 (pypdf is a free and open-source pure-python PDF library. Prior to 6.20 ...)
- pypdf 6.21.0-1
+ [trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-qfv9-64jg-mh7p
NOTE: https://github.com/py-pdf/pypdf/pull/4188
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/c9c35b4471c2eb5fe078094f6c816e69d4ed25a0 (6.20.1)
CVE-2026-113791 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
- pypdf 6.21.0-1
+ [trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-cgf9-327m-v77c
NOTE: https://github.com/py-pdf/pypdf/pull/4218
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/18bd2981a74479483a0b9507602c58a63d6c9b12 (6.21.0)
CVE-2026-113790 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
- pypdf 6.21.0-1
+ [trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-f54x-cmq8-qg57
NOTE: https://github.com/py-pdf/pypdf/pull/4218
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/18bd2981a74479483a0b9507602c58a63d6c9b12 (6.21.0)
CVE-2026-113789 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
- pypdf 6.21.0-1
+ [trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-6vvc-x485-93v7
NOTE: https://github.com/py-pdf/pypdf/pull/4219
@@ -2661,6 +2673,7 @@ CVE-2026-113787 (odf-kit allows users to generate, fill, read, and convert OpenD
NOT-FOR-US: odf-kit
CVE-2026-113786 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
- pypdf 6.21.1-1
+ [trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hx5-vpf9-5wcv
NOTE: https://github.com/py-pdf/pypdf/pull/4222
@@ -2880,15 +2893,19 @@ CVE-2024-4989 (The callback URL parameter in WSO2 API Manager fails to validate
NOT-FOR-US: WSO2
CVE-2026-102486 (Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 ...)
- ntpsec <unfixed> (bug #1151689)
+ [trixie] - ntpsec <no-dsa> (Minor issue)
NOTE: https://blog.ntpsec.org/2026/10/20/version-1.2.6.html
CVE-2026-102485 (Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec nt ...)
- ntpsec <unfixed> (bug #1151689)
+ [trixie] - ntpsec <no-dsa> (Minor issue)
NOTE: https://blog.ntpsec.org/2026/10/20/version-1.2.6.html
CVE-2026-102484 (Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd b ...)
- ntpsec <unfixed> (bug #1151689)
+ [trixie] - ntpsec <no-dsa> (Minor issue)
NOTE: https://blog.ntpsec.org/2026/10/20/version-1.2.6.html
CVE-2026-102483 (Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote atta ...)
- ntpsec <unfixed> (bug #1151689)
+ [trixie] - ntpsec <no-dsa> (Minor issue)
NOTE: https://blog.ntpsec.org/2026/10/20/version-1.2.6.html
CVE-2026-105482
- nodejs <unfixed>
@@ -4765,6 +4782,7 @@ CVE-2026-113866 (When setting up an account, Thunderbird's Exchange AutoDiscover
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2026-115/#CVE-2026-113866
CVE-2026-113776 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-8rjx-v5ww-45pp
NOTE: https://github.com/pypa/virtualenv/commit/602b26623a724827ff171bf11fef4ad186d01f74 (21.14.2)
CVE-2026-113744 (A security vulnerability has been detected in Tenda AC19 16.03.10.07. ...)
@@ -4785,12 +4803,14 @@ CVE-2026-113735 (A vulnerability was determined in D-Link DCS-6501LH 3.03.02. Af
NOT-FOR-US: D-Link
CVE-2026-113732 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-c947-3pg5-gm8q
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/3bddeaf8d02c3ee7f576503efb082f8f494cfcab (21.14.2)
CVE-2026-113731 (djust provides Phoenix LiveView-style reactive server-side rendering f ...)
NOT-FOR-US: djust
CVE-2026-113730 (OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, ...)
- ognl <unfixed>
+ [trixie] - ognl <no-dsa> (Minor issue)
NOTE: https://github.com/orphan-oss/ognl/security/advisories/GHSA-crwc-vw2r-qr6m
NOTE: https://github.com/orphan-oss/ognl/commit/f4c17f794754d516ea799c36ed8524d1b7fb98e2 (OGNL_3_4_13)
CVE-2026-113729 (Moov signedxml is a pure Go library for processing signed XML document ...)
@@ -4801,69 +4821,83 @@ CVE-2026-113727 (OpenChoreo is a developer platform for Kubernetes. From 1.0.0 u
NOT-FOR-US: OpenChoreo
CVE-2026-113726 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-5vjq-rrrf-7h2q
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/5b915367da82bd024b2a0d28d2f98007034b4aa2 (21.14.4)
CVE-2026-113725 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-vxj4-q4g9-crj7
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/c3104e02474b652832a9bbaae79f6e1696296932 (21.14.7)
CVE-2026-113724 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-43mp-35q3-x3fq
NOTE: https://github.com/pypa/virtualenv/pull/3427
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/2bfdc0230d1b2685fedfcfe66c835b9a2ec7c440 (21.14.9)
CVE-2026-113723 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-6w3r-xr62-4xcp
NOTE: https://github.com/pypa/virtualenv/pull/3418
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/5f48d711731311428aebfae61d46957762155b22 (21.14.9)
CVE-2026-113722 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-c978-59m8-c77v
NOTE: https://github.com/pypa/virtualenv/pull/3417
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/2519941bed33ee0d3ac99277f67913e439e476a9 (21.14.9)
CVE-2026-113721 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-558c-9hv2-4prj
NOTE: https://github.com/pypa/virtualenv/pull/3431
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/d25f28699eefb1fc34a251e5adf2b5de844c36cd (21.14.9)
CVE-2026-113720 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-fc2g-4w5p-6whm
NOTE: https://github.com/pypa/virtualenv/pull/3425
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/35f0b33562790176dd186d0a3c517af3acc7a0e1 (21.14.9)
CVE-2026-113719 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-hhxq-47xx-j5xx
NOTE: https://github.com/pypa/virtualenv/pull/3428
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/e3cea6fa10a50fa29cf1fdddd772458fba076d5f (21.14.9)
CVE-2026-113718 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-394h-qwmc-48pf
NOTE: https://github.com/pypa/virtualenv/pull/3432
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/e5fc2e6e189a877ff559af288919e3525d13e5e0 (21.14.9)
CVE-2026-113717 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-cx28-75q4-x26q
NOTE: https://github.com/pypa/virtualenv/pull/3430
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96 (21.14.9)
CVE-2026-113716 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-cw65-gx24-rc82
NOTE: https://github.com/pypa/virtualenv/pull/3429
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/554d9f9d4f7758f5cf53f993031e29787f1f74c5 (21.14.9)
CVE-2026-113715 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-qmx5-4p3x-wvqf
NOTE: https://github.com/pypa/virtualenv/pull/3426
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/b0008a58885ded9227faf8f910c6c402712c750a (21.14.9)
CVE-2026-113714 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-494p-63j8-28p3
NOTE: https://github.com/pypa/virtualenv/pull/3430
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/7babec66e043e1cc8bc66869a063653898719d96 (21.14.9)
CVE-2026-113713 (virtualenv is a tool for creating isolated virtual python environments ...)
- python-virtualenv <unfixed> (bug #1151685)
+ [trixie] - python-virtualenv <no-dsa> (Minor issue)
NOTE: https://github.com/pypa/virtualenv/security/advisories/GHSA-4f8h-vr72-p32c
NOTE: https://github.com/pypa/virtualenv/pull/3437
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/b81995c3feab9e1edb453c75ffc6616e1a77335e (21.14.10)
@@ -7107,6 +7141,7 @@ CVE-2026-96402 (A malicious USB MTP/PTP device can cause the USBX host to read p
NOT-FOR-US: Eclipse
CVE-2026-95168 (An issue in nvbn thefuck v.3.32 allows a local attacker to execute arb ...)
- thefuck <unfixed>
+ [trixie] - thefuck <no-dsa> (Minor issue)
NOTE: https://github.com/nvbn/thefuck/issues/1623
CVE-2026-95111 (A memory-protected ThreadX module's queue request reaches the Module M ...)
NOT-FOR-US: Eclipse
@@ -8664,6 +8699,7 @@ CVE-2026-112377 (CCC Attestation SIG attested-tls-poc through commit 731ca82 fai
NOT-FOR-US: CCC Attestation SIG attested-tls-poc
CVE-2026-112368 (An uncontrolled recursion weakness in the BSON decoding logic of the M ...)
- php-mongodb <unfixed>
+ [trixie] - php-mongodb <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/PHPC-276
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/795e914e6f7cc631a2f80c89aedcdd2a1df4ada9 (2.5.5, 2.1.12, 1.21.12)
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/01363996a93b33fea58c90f5e8d1eaea5e01eafd (2.5.5, 2.1.12, 1.21.12)
@@ -13944,6 +13980,7 @@ CVE-2026-109413 (In Symfony YAML prior to versions5.4.54,6.4.45,7.4.18, and8.1.6
NOTE: https://github.com/symfony/symfony/pull/65688
CVE-2026-109383 (undici is an HTTP client library for Node.js. In versions 4.0.0 throug ...)
- node-undici 8.12.2+dfsg+~cs3.2.3-1
+ [trixie] - node-undici <no-dsa> (Minor issue)
NOTE: https://github.com/nodejs/undici/security/advisories/GHSA-2m5v-pch6-74hx
CVE-2026-109131 (The Hub collection module documentation renderer in the unified Ansibl ...)
NOT-FOR-US: Red Hat Ansible Automation Platform
=====================================
data/dsa-needed.txt
=====================================
@@ -106,6 +106,8 @@ network-manager-vpnc
--
node-dompurify
--
+nodejs
+--
nsd
--
nss (carnil)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7abaff18c2de5a487f17891ab786ff31187d4f62
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7abaff18c2de5a487f17891ab786ff31187d4f62
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/0ee0a18e/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list