[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Sat Oct 24 17:45:01 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
b163e959 by Moritz Muehlenhoff at 2026-10-24T18:44:45+02:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -68,6 +68,7 @@ CVE-2026-87835 (The Front End Users WordPress plugin through 3.2.35 does not res
NOT-FOR-US: WordPress plugin
CVE-2026-83813 (Twisted is an event-based framework for internet applications, support ...)
- twisted <unfixed>
+ [trixie] - twisted <no-dsa> (Minor issue)
NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-jj36-9pvh-vj5r
NOTE: https://github.com/twisted/twisted/pull/12700
NOTE: Fixed by: https://github.com/twisted/twisted/commit/b53e1c3477c209b5609a1c74cf9e48373b5879ac (twisted-26.10.0rc1)
@@ -263,6 +264,7 @@ CVE-2026-115883 (LangGraph checkpoint savers provide Postgres- and SQLite-backed
NOT-FOR-US: LangGraph
CVE-2026-115877 (Twisted is an event-based framework for internet applications, support ...)
- twisted <unfixed>
+ [trixie] - twisted <no-dsa> (Minor issue)
NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-q7qq-6mhp-9rc4
NOTE: https://github.com/twisted/twisted/pull/12755
NOTE: Fixed by: https://github.com/twisted/twisted/commit/022b6f7feb5980166c71f54e2c0d8f4f21ff6e1a (twisted-26.10.0rc1)
@@ -301,23 +303,27 @@ CVE-2026-115785 (An SMTP command injection vulnerability in the data-source test
NOT-FOR-US: Zimbra
CVE-2026-115778 (Twisted is an event-based framework for internet applications, support ...)
- twisted <unfixed>
+ [trixie] - twisted <no-dsa> (Minor issue)
NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-cwm5-jh59-mwxr
NOTE: https://github.com/twisted/twisted/pull/12750
NOTE: Fixed by: https://github.com/twisted/twisted/commit/073ba878c6c07d569cb61abc5ae76d46eff1b529 (twisted-26.10.0rc1)
NOTE: Fixed by: https://github.com/twisted/twisted/commit/5d91cc66a3591faba758a80a1479e0103602facc (twisted-26.10.0rc1)
CVE-2026-115776 (Twisted is an event-based framework for internet applications, support ...)
- twisted <unfixed>
+ [trixie] - twisted <no-dsa> (Minor issue)
NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-53xc-49m8-p798
NOTE: https://github.com/twisted/twisted/pull/12771
NOTE: Fixed by: https://github.com/twisted/twisted/commit/01f8cff7753c1edac132380b2ea939fa6bdbab30 (twisted-26.10.0rc1)
NOTE: Fixed by: https://github.com/twisted/twisted/commit/ac90fb7b0ab73688a581fcd9a7c0577ec8ca3059 (twisted-26.10.0rc1)
CVE-2026-115775 (Twisted is an event-based framework for internet applications, support ...)
- twisted <unfixed>
+ [trixie] - twisted <no-dsa> (Minor issue)
NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-3476-c5c2-fr73
NOTE: https://github.com/twisted/twisted/pull/12751
NOTE: Fixed by: https://github.com/twisted/twisted/commit/8873814bec8288e2466fad4d2c4d64039beb88b0 (twisted-26.10.0rc1)
CVE-2026-115774 (Twisted is an event-based framework for internet applications, support ...)
- twisted <unfixed>
+ [trixie] - twisted <no-dsa> (Minor issue)
NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-2qrf-pqgx-qh9v
NOTE: https://github.com/twisted/twisted/pull/12764
NOTE: Fixed by: https://github.com/twisted/twisted/commit/3d125548bcbe955007cb97f480bb699a5e074741 (twisted-26.10.0rc1)
@@ -1745,10 +1751,12 @@ CVE-2026-77156 (Incomplete validation of extracted archive entry paths in ast-cl
NOT-FOR-US: Checkmarx/ast-cli
CVE-2026-75508 (GraphQL-core is a Python port of the GraphQL.js reference implementati ...)
- graphql-core 3.2.12-1
+ [trixie] - graphql-core <no-dsa> (Minor issue)
NOTE: https://github.com/graphql-python/graphql-core/security/advisories/GHSA-r77w-qph3-7vf8
NOTE: Fixed by: https://github.com/graphql-python/graphql-core/commit/80ef435a1808fbbcc4aaac63ae76771a1c91002d (v3.2.12)
CVE-2026-75507 (GraphQL-core is a Python port of the GraphQL.js reference implementati ...)
- graphql-core 3.2.12-1
+ [trixie] - graphql-core <no-dsa> (Minor issue)
NOTE: https://github.com/graphql-python/graphql-core/security/advisories/GHSA-vj8h-fx38-h3vc
NOTE: Fixed by: https://github.com/graphql-python/graphql-core/commit/29c2753a7ee30a96a4109e7c6add1a2dae0497d7 (v3.2.12)
CVE-2026-67597
@@ -1831,9 +1839,13 @@ CVE-2026-115506 (libexpat through 2.9.0 contains a denial of service vulnerabili
[trixie] - expat <no-dsa> (Minor issue)
NOTE: https://github.com/libexpat/libexpat/pull/1433
CVE-2026-115505 (libsmb2 before 6.3 contains integer overflow vulnerabilities in the DC ...)
- - libsmb2 <undetermined>
+ - libsmb2 <unfixed>
+ [trixie] - libsmb2 <no-dsa> (Minor issue)
+ NOTE: https://github.com/sahlberg/libsmb2/commit/a79f6914cb5ed3f74293d15cdea901261ce179ff (libsmb2-6.3)
+ NOTE: https://github.com/sahlberg/libsmb2/issues/496
CVE-2026-115504 (CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ...)
- cfitsio <unfixed>
+ [trixie] - cfitsio <no-dsa> (Minor issue)
NOTE: https://github.com/HEASARC/cfitsio/pull/184
NOTE: Fixed by: https://github.com/HEASARC/cfitsio/commit/579792e0f85bff0c6733ad5ebdf54c3b5c188686
CVE-2026-115503 (Ghidra before 12.2 contains an improper handling of highly compressed ...)
@@ -3446,8 +3458,11 @@ CVE-2026-105926 (The Pulsar broker serves two schema commands on its binary prot
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-105923 (A malicious SVG can trigger an integer overflow which in turn triggers ...)
- qt6-base <unfixed>
+ [trixie] - qt6-base <no-dsa> (Minor issue)
- qtbase-opensource-src <unfixed>
+ [trixie] - qtbase-opensource-src <no-dsa> (Minor issue)
- qtbase-opensource-src-gles <unfixed>
+ [trixie] - qtbase-opensource-src-gles <no-dsa> (Minor issue)
NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/762279
NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-105923:
NOTE: Fixed by: https://github.com/qt/qtbase/commit/d2129a7f0e1f2ebef3f4897276db9b5b05874d8f (6.11-branch)
@@ -7992,11 +8007,11 @@ CVE-2026-113681 (OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x b
NOTE: https://github.com/AcademySoftwareFoundation/OpenImageIO/pull/5568
NOTE: Fixed by: https://github.com/AcademySoftwareFoundation/OpenImageIO/commit/07e3c3e0373551c57e7d8e01353deaa4b3646613 (main)
CVE-2026-113680 (HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference ...)
- - harfbuzz <unfixed>
+ - harfbuzz <not-affected> (wasm backend not enabled in Debian)
NOTE: https://github.com/harfbuzz/harfbuzz/pull/6414
NOTE: Fixed by: https://github.com/harfbuzz/harfbuzz/commit/a71aa86c2bac114fafb6b47f8da02024ecb44fa6 (15.0.0)
CVE-2026-113679 (HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerab ...)
- - harfbuzz <unfixed>
+ - harfbuzz <not-affected> (wasm backend not enabled in Debian)
NOTE: https://github.com/harfbuzz/harfbuzz/pull/6414
NOTE: Fixed by: https://github.com/harfbuzz/harfbuzz/commit/5e821de8256d01780566b5c8ab7886fae4c93da8 (15.0.0)
CVE-2026-113678 (Froxlor before 2.3.15 contains a symlink following vulnerability in St ...)
@@ -111591,7 +111606,7 @@ CVE-2026-71263 (The LINUXTCP port of FreeModbus contains an off-by-one bounds ch
CVE-2026-71262 (IoTSharp BlobStorageController.cs lacks the [Authorize] attribute appl ...)
NOT-FOR-US: IoTSharp
CVE-2026-71261 (dr_libs dr_wav.h (all versions through current master) contains an int ...)
- TODO: check if embedded copy has security impact in roc-toolkit, qtads, qt6-multimedia, octave-ltfat, raylib, dosbox-x, mlpack and faudio
+ NOTE: Bogus report for dr_libs without actionable data
CVE-2026-71260 (ESPHome through 2026.7.0-dev discloses plaintext passwords via its web ...)
NOT-FOR-US: ESPHome
CVE-2026-71259 (ESPHome through 2026.7.0-dev contains an operator-precedence bug in th ...)
@@ -308365,6 +308380,7 @@ CVE-2025-53629 (cpp-httplib is a C++11 single-file header-only cross platform HT
CVE-2025-53628 (cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTT ...)
[experimental] - cpp-httplib 0.25.0+ds-1
- cpp-httplib 0.25.0+ds-3 (bug #1109340)
+ [trixie] - cpp-httplib <no-dsa> (Minor issue)
NOTE: https://github.com/yhirose/cpp-httplib/security/advisories/GHSA-j6p8-779x-p5pw
NOTE: https://github.com/yhirose/cpp-httplib/commit/17ba303889b8d4d719be3879a70639ab653efb99 (v0.23.0)
CVE-2025-53626 (pdfme is a TypeScript-based PDF generator and React-based UI. The expr ...)
=====================================
data/dsa-needed.txt
=====================================
@@ -30,8 +30,12 @@ condor
--
containerd
--
+coturn
+--
cups
--
+cyrus-imapd
+--
dpdk
--
dokuwiki
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b163e9594c64a0dd9a160c0829fd0ccc1d3d2ada
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b163e9594c64a0dd9a160c0829fd0ccc1d3d2ada
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261024/b177e4a9/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list