[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Oct 23 22:56:57 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ffb4678c by Moritz Muehlenhoff at 2026-10-23T23:56:28+02:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -932,6 +932,7 @@ CVE-2026-97635 (The Agent Zero Web UI before 1.15 does not correctly sanitize us
NOT-FOR-US: Agent Zero Web UI
CVE-2026-97631 (EDK2 contains a vulnerability in BIOS where a user may cause \u201cOut ...)
- edk2 <unfixed>
+ [trixie] - edk2 <no-dsa> (Minor issue)
NOTE: https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
NOTE: https://github.com/tianocore/edk2/pull/13302
NOTE: Fixed by: https://github.com/tianocore/edk2/commit/14cdbb86a1a4f9bcce0d6cb78b04af58f226cf48
@@ -1216,6 +1217,7 @@ CVE-2026-115507 (Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerabi
NOT-FOR-US: Vikunja
CVE-2026-115506 (libexpat through 2.9.0 contains a denial of service vulnerability beca ...)
- expat <unfixed> (bug #1151841)
+ [trixie] - expat <no-dsa> (Minor issue)
NOTE: https://github.com/libexpat/libexpat/pull/1433
CVE-2026-115505 (libsmb2 before 6.3 contains integer overflow vulnerabilities in the DC ...)
- libsmb2 <undetermined>
@@ -1417,8 +1419,9 @@ CVE-2026-115322 (Bytebase before 3.16.0 contains an authorization bypass vulnera
CVE-2026-115321 (Bytebase before 3.16.0 contains an authorization bypass vulnerability ...)
NOT-FOR-US: Bytebase
CVE-2026-115319 (fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexi ...)
- - fzf <unfixed>
+ - fzf <unfixed> (unimportant)
NOTE: Fixed by: https://github.com/junegunn/fzf/commit/b412a450538e5f4a1d7057732e75d945dafa18a6
+ NOTE: Crash in CLI tool, no security impact
CVE-2026-115253 (An incorrect permission assignment vulnerability in the WatchGuard Age ...)
NOT-FOR-US: WatchGuard
CVE-2026-115249 (A flaw has been found in subhajitkhan online-clinic-management-system ...)
@@ -1791,6 +1794,7 @@ CVE-2026-90458 (OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_
NOTE: https://security.openstack.org/ossa/OSSA-2026-047.html
CVE-2026-XXXX [RUSTSEC-2026-0382]
- rust-rustls-webpki <unfixed> (bug #1151660)
+ [trixie] - rust-rustls-webpki <no-dsa> (Minor issue)
NOTE: https://rustsec.org/advisories/RUSTSEC-2026-0382.html
CVE-2026-XXXX [GHSA-wq25-fm54-5q3q: aide (>= 0.16 <= 0.19.4) improper handling of file names containing invalid UTF-8 byte sequences (AIDE detection bypass)]
- aide 0.19.5-1
@@ -4940,6 +4944,7 @@ CVE-2026-111943 (On most platforms, Go uses the given system root certificates.
- golang-1.26 <unfixed>
- golang-1.25 <removed>
- golang-1.24 <removed>
+ [trixie] - golang-1.24 <no-dsa> (Minor issue)
- golang-1.19 <removed>
NOTE: https://github.com/golang/go/issues/82345
NOTE: Fixed by: https://github.com/golang/go/commit/90617fb7ceb59cf08bee7826bb51b8c8fb8c11de (go1.27.3)
@@ -7477,9 +7482,11 @@ CVE-2026-113505 (A flaw has been found in aaPanel up to 8.25.0. Impacted is the
NOT-FOR-US: aaPanel
CVE-2026-113496 (A flaw was found in cockpit-machines. When saving Virtual Network Comp ...)
- cockpit-machines <unfixed>
+ [trixie] - cockpit-machines <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2556058
CVE-2026-113495 (A flaw was found in cockpit-machines. Red Hat Subscription Management ...)
- cockpit-machines <unfixed>
+ [trixie] - cockpit-machines <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2556057
CVE-2026-113469 (A failure has been identified in the SNS during dynamic data files sig ...)
NOT-FOR-US: SNS
@@ -8418,9 +8425,11 @@ CVE-2023-42990
REJECTED
CVE-2026-71482
- golang-github-containerd-stargz-snapshotter <unfixed>
+ [trixie] - golang-github-containerd-stargz-snapshotter <no-dsa> (Minor issue)
NOTE: https://github.com/containerd/stargz-snapshotter/security/advisories/GHSA-6q59-3mx3-jpgq
CVE-2026-77395
- golang-github-containerd-stargz-snapshotter <unfixed>
+ [trixie] - golang-github-containerd-stargz-snapshotter <no-dsa> (Minor issue)
NOTE: https://github.com/containerd/stargz-snapshotter/security/advisories/GHSA-6j84-h5gg-w3gr
CVE-2026-108518 (DBI versions before 1.656 for Perl crash via type confusion in dbi_pro ...)
- libdbi-perl 1.656-1 (bug #1151666)
@@ -9149,7 +9158,7 @@ CVE-2025-55667 (A segmentation violation in the dump_isom_saps function (/mp4box
CVE-2025-55654 (A use-after-free in the gf_filter_pid_get_packet function (filter_core ...)
- gpac <removed>
CVE-2025-52290 (A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames f ...)
- - ffmpeg <unfixed>
+ - ffmpeg <undetermined>
NOTE: https://www.openwall.com/lists/oss-security/2026/10/20/6
CVE-2025-13591 (The authentication endpoint of WSO2 Identity Server fails to provide a ...)
NOT-FOR-US: WSO2
@@ -15293,18 +15302,22 @@ CVE-2026-110227 (Missing Authorization vulnerability in 10up Restricted Site Acc
NOT-FOR-US: WordPress plugin or theme
CVE-2026-109971 (A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 ...)
- clevis <unfixed> (bug #1150905)
+ [trixie] - clevis <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2550363
NOTE: Fixed by: https://github.com/latchset/clevis/commit/a0b7f4ba9d0f803a525ae42aa3112aea57159b63 (v24)
CVE-2026-109970 (A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-ask ...)
- clevis <unfixed> (bug #1150905)
+ [trixie] - clevis <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2550362
NOTE: Fixed by: https://github.com/latchset/clevis/commit/3a77c12c2497869b143aa909c56954aa2a79fc20 (v24)
CVE-2026-109969 (A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-s ...)
- clevis <unfixed> (bug #1150905)
+ [trixie] - clevis <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2550361
NOTE: Fixed by: https://github.com/latchset/clevis/commit/5a53a404bca9dfd046da73089c6918658de6573d (v24)
CVE-2026-109968 (A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-s ...)
- clevis <unfixed> (bug #1150905)
+ [trixie] - clevis <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2462394
NOTE: Fixed by: https://github.com/latchset/clevis/commit/85e7ad3f6ae0a1c09c9d7f980acd9b7d7850a02a (v24)
CVE-2026-109901 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
@@ -20391,6 +20404,7 @@ CVE-2026-10759 (A flaw in Portal for ArcGIS could allow LDAP injection through a
NOT-FOR-US: Esri
CVE-2026-109976 (A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-s ...)
- clevis <unfixed> (bug #1150905)
+ [trixie] - clevis <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2550375
NOTE: Fixed by: https://github.com/latchset/clevis/commit/f459bc0b9258d3401bda7c46f1a036db874b130d (v24)
CVE-2026-109967 (yt-dlp-web-ui through 4.0.0 contains a NULL pointer dereference vulner ...)
@@ -24459,6 +24473,7 @@ CVE-2026-100147 (The FunnelKit \u2013 Funnel Builder for WooCommerce Checkout pl
NOT-FOR-US: WordPress plugin
CVE-2026-107794 (ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a ...)
- libextutils-typemaps-default-perl 1.07-1 (bug #1150541)
+ [trixie] - libextutils-typemaps-default-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44246012/
NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=91213
NOTE: Fixed by: https://github.com/tsee/extutils-typemap-default/commit/10f45bf0d00d3140499755c2ad49f8bf435851ac (ExtUtils-Typemaps-Default-1.07)
@@ -24470,6 +24485,7 @@ CVE-2013-10076 (ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl al
NOTE: Fixed by: https://github.com/tsee/extutils-typemap-default/commit/0eb696b75afcfedbf87a72e11d44d98110863934 (ExtUtils-Typemaps-Default-1.05)
CVE-2026-107373 (ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_ST ...)
- libextutils-typemaps-default-perl 1.07-1 (bug #1150541)
+ [trixie] - libextutils-typemaps-default-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44245994/
NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=94110
NOTE: Fixed by: https://github.com/tsee/extutils-typemap-default/commit/a6b9c298b34ddadc582961403e715d292f82a22d (ExtUtils-Typemaps-Default-1.06)
=====================================
data/dsa-needed.txt
=====================================
@@ -32,12 +32,18 @@ containerd
--
cups
--
+dpdk
+--
+dokuwiki
+--
dulwich
--
emacs (jmm)
--
ejabberd
--
+eog (jmm)
+--
firebird3.0
--
firebird4.0
@@ -69,6 +75,8 @@ jupyterlab
--
kitty
--
+libcpanel-json-xs-perl
+--
libheif (aron)
--
libnet-idn-encode-perl (carnil)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ffb4678c933f516ca8c8e0615bf511eb850573fc
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ffb4678c933f516ca8c8e0615bf511eb850573fc
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261023/71178faa/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list